test+fix: close #14, V2 #57 live install entry, #41 float slice

- #14: first scheduled lock bump confirmed (8fded63 nomarchy-bump Mon
  05:20 UTC 2026-07-06); remove queue item.
- #57 V2: checks.live-install-entry builds nomarchy-live HM gen and
  asserts Install Nomarchy.desktop + installer bin + menu gate.
- #41: float/center hyprpolkitagent + pinentry-qt from package app-ids;
  capture-float-classes.nix harness (softGL empty); residual portal
  class stays NEXT [blocked:hw]. HARDWARE-QUEUE confirm steps.

Verified: live-install-entry + windowrule-syntax green.

modules/home/hyprland.nix

@@ -469,12 +469,12 @@ in
       # Class regexes use `(?i)` and tolerate the XWayland
       # `.…-wrapped` binary-name form.
       #
-      # Conservative set on purpose (item 41): only windows the distro
-      # actually ships, each an unambiguous dialog. Deliberately NOT
-      # floated yet — needs on-hardware class verification: the polkit auth
-      # prompt (hyprpolkitagent exposes no discoverable class) and GTK
-      # file-chooser portals. A dead rule is harmless, but guessing a class
-      # is worse than leaving it for a verified pass.
+      # Conservative set (item 41): only dialogs we ship or can name from
+      # package strings / desktop files. SoftGL capture harness could not
+      # materialize polkit/pinentry windows (empty hyprctl clients) — classes
+      # below are from binary/app-id strings (hyprpolkitagent, pinentry-qt).
+      # Remaining: GTK file-chooser portal — class still unknown headlessly;
+      # HARDWARE-QUEUE for live hyprctl clients confirmation.
       windowrule = [
         # Audio mixer (item 35): right-click the Waybar volume module.
         "float 1, match:class ^(com\\.saivert\\.pwvucontrol|org\\.pulseaudio\\.pavucontrol|pavucontrol)$"
@@ -490,6 +490,13 @@ in
         "float 1, match:class ^(com\\.nomarchy\\.calendar)$"
         "size 60% 65%, match:class ^(com\\.nomarchy\\.calendar)$"
         "center 1, match:class ^(com\\.nomarchy\\.calendar)$"
+
+        # Polkit auth (hyprpolkitagent — app id / binary name in the package)
+        # and pinentry-qt (keys.nix default; org.gnupg.pinentry-qt desktop).
+        "float 1, match:class (?i)^(hyprpolkitagent|\\.hyprpolkitagent-wrapped)$"
+        "center 1, match:class (?i)^(hyprpolkitagent|\\.hyprpolkitagent-wrapped)$"
+        "float 1, match:class (?i)^(pinentry(-qt)?|org\\.gnupg\\.pinentry-qt)$"
+        "center 1, match:class (?i)^(pinentry(-qt)?|org\\.gnupg\\.pinentry-qt)$"
       ];
 
       # Rendered from ./keybinds.nix (the cheatsheet reads the same list),