docs(desktop): document polkit agent configuration and package requirements

docs/desktop/index.mdx

@@ -28,7 +28,7 @@ Three Wayland compositors are configured side by side. niri is the original setu
 
 | Source | Packages |
 | --- | --- |
-| pacman | `niri`, `noctalia` (the CachyOS build where that repo is configured, else `extra`), `xwayland-satellite`, `polkit-gnome`, `uwsm`, `xdg-user-dirs`, Wayland utilities (`wl-clipboard`, `cliphist`, `wtype`, `ydotool`, `grim`, `slurp`, `hyprpicker`, `pamixer`, `brightnessctl`, `libnotify`), the bound apps (`nautilus`, `imv`, `mpv`, `evince`, `chromium`, `obsidian`), and strata's runtime deps |
+| pacman | `niri`, `noctalia` (the CachyOS build where that repo is configured, else `extra`), `xwayland-satellite`, `polkit`, `polkit-gnome`, `uwsm`, `xdg-user-dirs`, Wayland utilities (`wl-clipboard`, `cliphist`, `wtype`, `ydotool`, `grim`, `slurp`, `hyprpicker`, `pamixer`, `brightnessctl`, `libnotify`), the bound apps (`nautilus`, `imv`, `mpv`, `evince`, `chromium`, `obsidian`), and strata's runtime deps |
 | AUR via `yay`/`paru` (a sync repo wins when it has the name) | `vicinae-bin`, `tldraw-offline-bin`, and the desktop apps `beeper-bin`, `fastmail`, `1password`, `brave-origin-bin`, `claude-desktop`, `spotify` |
 | `[omarchy]` repo, when configured | `herdr`, `flea`, `voxtype-bin`, `xdg-terminal-exec`, `hyprland-preview-share-picker` |
 | `[cachyos]` repo, when configured | `umbriel`, `xdg-desktop-portal-umbriel` |

docs/desktop/umbriel.mdx

@@ -5,6 +5,8 @@ description: Umbriel scrolling compositor config — Noctalia-only session, niri
 
 [Umbriel](https://docs.noctalia.dev/umbriel/) is a wlroots scrolling compositor from the Noctalia project. The config ports the [niri](/desktop/niri) layout, rules, springs, and binds, and adds the per-app scratch workspaces from [Hyprland](/desktop/hyprland) as Umbriel scratchpads. The session starts only `noctalia`: its launcher, clipboard history, polkit agent, notifications, and OSD replace vicinae, cliphist, and polkit-gnome.
 
+Noctalia's polkit agent is off by default. `dot_config/noctalia/config.toml` (→ `~/.config/noctalia/config.toml`, merged under the GUI's unmanaged `~/.local/state/noctalia/settings.toml`) sets `[shell] polkit_agent = true`, so `pkexec` and other privileged actions prompt in a Noctalia panel. `polkitd` itself is D-Bus activated (`polkit.service` is static; nothing to enable). The setting also applies under niri, which still starts polkit-gnome: only one agent registers per session, whichever starts first.
+
 :::note
 Linux `desktop` and `laptop` roles only (`.chezmoiignore.tmpl`). `umbriel` and its portal backend `xdg-desktop-portal-umbriel` (screenshots and screen sharing for portal clients) come from the `[cachyos]` repo (`packages.arch.desktop.cachyos`); the AUR `umbriel` is a placeholder and `umbriel-git` conflicts with the repo build, so other Arch machines install them by hand.
 :::