libvirt group: check at summary time (final state) + OR-semantics gate

Fresh-VM timeline explained: on run 1 virt-manager installs AFTER the
niri module's prereq check ran (menu dispatch order), so the group add
was evaluated against a package state that did not include it yet. A
second run 'fixed' it — matching the observed behavior.

- New ensure_libvirt_group runs in the Summary section, seeing the FINAL
  package state; menu/module-time check kept as an early pass.
- pkg_installed is AND-semantics (all must be installed); the gate needs
  OR. New pkg_installed_any helper; both gates switched to it.
- Also fixed a set -e trap: '$done_any && ok' returned 1 (killing the
  script) when no optional tools were picked — replaced with an if.
All four gate cases harness-proven: virt-only, menu-pick, no-virt,
already-in-group.

lib/common.sh

@@ -92,6 +92,17 @@ pkg_installed() {
     return 0
 }
 
+# True if ANY of the listed packages is installed (pkg_installed is AND).
+pkg_installed_any() {
+    local p
+    for p in "$@"; do
+        if rpm -q "$p" &>/dev/null; then
+            return 0
+        fi
+    done
+    return 1
+}
+
 remove_packages() {
     local packages_to_remove=()
     for pkg in "$@"; do

lib/session.sh

@@ -134,7 +134,7 @@ UNIT
     # requires libvirt-glib client-side, so on a fresh VM libvirt can be
     # functionally present via libvirt-daemon* without rpm -q libvirt passing
     # (VM-proven: user stuck in yuri+wheel with virt-manager installed).
-    if pkg_installed libvirt libvirt-daemon libvirt-daemon-driver-qemu virt-manager \
+    if pkg_installed_any libvirt libvirt-daemon libvirt-daemon-driver-qemu virt-manager \
         || [[ -x /usr/sbin/libvirtd ]]; then
         local real_user="${SUDO_USER:-$USER}"
         if ! id -nG "$real_user" 2>/dev/null | grep -qw libvirt; then