Session prereqs: libvirt group membership when libvirt is installed

The error CHANGED on the VM: 'no polkit agent' -> 'access denied by
policy' — the agent unit works; polkit now denies because the user is
not in the libvirt group (fresh run without picking QEMU from the menu,
or no re-login after the pick).

install_session_prereqs now adds the user to the libvirt group whenever
libvirt is installed (idempotent via id -nG check), decoupled from the
advanced-menu choice. Applies after re-login.

lib/session.sh

@@ -125,4 +125,15 @@ UNIT
         sudo ln -sf ../polkit-agent.service \
             /etc/systemd/user/graphical-session.target.wants/polkit-agent.service
     fi
+
+    # libvirt group: members manage qemu:///system without a polkit prompt.
+    # Without this, virt-manager dies on "access denied by policy" even with
+    # a working agent (VM-proven). Idempotent; applies after re-login.
+    if pkg_installed libvirt; then
+        local real_user="${SUDO_USER:-$USER}"
+        if ! id -nG "$real_user" 2>/dev/null | grep -qw libvirt; then
+            info "Adding $real_user to the libvirt group (re-login to apply)..."
+            sudo usermod -aG libvirt "$real_user"
+        fi
+    fi
 }