feat(polkit): restrict systemd + udisks system actions to active local sessions

Two narrow defence-in-depth rules:

- 52-systemd-local-only: org.freedesktop.systemd1.* requires both
  subject.local and subject.active. Wheel-via-sudo-rs is on a different
  path (sudoers) and is not affected. Stops a non-active or remote
  polkit caller from start/stop/restart of system units.

- 53-udisks-system-mount: filesystem-mount-system and modify-system
  require subject.active. The everyday USB auto-mount path uses
  filesystem-mount (no -system suffix) and is unaffected.

Audited against current workflow (virt-manager, networkctl, USB mount,
bluetoothctl, fwupdmgr) — none of these break.

1 files changed, 12 insertions, 0 deletions

diff --git a/etc/polkit-1/rules.d/52-systemd-local-only.rules b/etc/polkit-1/rules.d/52-systemd-local-only.rules
new file mode 100644
index 0000000..bcfd347
--- /dev/null
+++ b/etc/polkit-1/rules.d/52-systemd-local-only.rules
@@ -0,0 +1,12 @@
+// Restrict systemd unit management via polkit to active local sessions.
+// Wheel-via-sudo-rs is unaffected (sudoers is a separate authorisation
+// path). Stops a remote SSH session (no `subject.local`) or a background
+// non-active session from start/stop/restart/reload of system units via
+// the polkit gate.
+polkit.addRule(function (action, subject) {
+  if (action.id.indexOf("org.freedesktop.systemd1.") === 0) {
+    if (!subject.local || !subject.active) {
+      return polkit.Result.NO;
+    }
+  }
+});