Fresh-VM repro: user in yuri+wheel with virt-manager installed. Gate was 'pkg_installed libvirt', but virt-manager does NOT require the 'libvirt' metapkg (verified vs F44 package page: requires libvirt-glib etc., client side only) — so the usermod never fired. Gate now: libvirt OR libvirt-daemon OR libvirt-daemon-driver-qemu OR virt-manager packages, or an existing /usr/sbin/libvirtd binary.