feat: ship the polkit-agent unit — cce-authenticator is the session's authenticator

The agent half of this crate (PolkitAgent zbus interface, polkit-agent-helper-1 driver, PAM + fprintd) has been complete for a while but nothing ever started it: the cce session ran with NO polkit authentication agent, so every pkexec in the DE — settings-app sysfs writes, bluetooth power, storage backup, package updates — died instantly trying to open a textual prompt on a terminal GUI apps don't have. The failures were silent; the settings app's optimistic-revert UI was the only visible symptom.

cce-polkit-agent.service (WantedBy=graphical-session.target, the notifier/cloud convention) runs the binary argless = agent mode. It resolves the session id itself — XDG_SESSION_ID, /proc/self/sessionid, then logind GetSessionByPID — though startcce now also imports XDG_SESSION_ID into the user manager (it was missing from the import-environment list, which is what crash-looped the interim Soteria attempt 26 times). A native cce-ui auth window also sidesteps the focus problem the GTK agent's dialog had: it never accepted keyboard input under cce-fx and polkit timed it out.

Registration verified live: 'Successfully registered CCE Authenticator agent' for the active session, unit stable.

Co-Authored-By: Claude <[email protected]>

 cce-polkit-agent.service | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/cce-polkit-agent.service b/cce-polkit-agent.service
new file mode 100644
index 0000000..372da51
--- /dev/null
+++ b/cce-polkit-agent.service
@@ -0,0 +1,20 @@
+[Unit]
+Description=CCE polkit authentication agent (cce-authenticator)
+After=graphical-session.target
+PartOf=graphical-session.target
+
+[Service]
+Type=simple
+# No args = polkit-agent mode: registers on the session via D-Bus (resolving
+# the session id itself: $XDG_SESSION_ID, /proc/self/sessionid, then logind
+# GetSessionByPID) and opens a native cce-ui window per authentication
+# request, driving polkit-agent-helper-1 / PAM / fprintd. Without a session
+# agent every pkexec in the DE (settings-app sysfs writes, bluetooth power,
+# storage backup, package updates) fails silently.
+ExecStart=%h/.local/bin/cce-authenticator
+Restart=on-failure
+RestartSec=3
+Environment=RUST_LOG=info
+
+[Install]
+WantedBy=graphical-session.target