fix(snapshots): un-break the GUI — polkit agent + launcher, not an override

Re-diagnosis of the "btrfs-assistant 2.2 segfaults on launch" bug, and
the fix is not the planned nixpkgs override:

1. gdb: the crash is btrfs_util_subvolume_iterator_next() —
   libbtrfsutil's UNPRIVILEGED subvolume-iteration path in btrfs-progs
   6.17.1 (upstream-fixed after 6.17.1, kdave/btrfs-progs 886571653).
   Symbol versions were checked and match: not ABI/link drift.
2. VM A/B on real btrfs: as root it works (exit 0); as a user it
   segfaults (139). The pkexec launcher runs it as root — so the GUI
   path was fine all along, except…
3. …the distro shipped NO polkit authentication agent: every pkexec
   prompt in the session failed silently. That is the actual root
   cause of "the GUI doesn't open".

Shipped: hyprpolkitagent (Hyprland's Qt agent — the prompt is
Stylix-themed) via exec-once in hyprland.nix; `nomarchy-menu snapshot`
prefers btrfs-assistant-launcher again, with the nomarchy-snapshots
fzf flow kept as fallback (and for SSH); checks.snapshot-gui guards
the root path + offscreen GUI event loop on a real btrfs volume so a
lock bump can't silently regress it. No btrfs-progs patch: all our
flows are root-side; the unprivileged fix arrives with a lock bump.

Verified: V0 (flake check) + V2 (snapshot-gui check, executed green) +
V1 (HM generation builds; hyprland.conf carries the agent exec-once;
generated menu passes bash -n with the launcher wiring). Remaining V3
queued: first on-hardware themed polkit prompt.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -744,13 +744,24 @@ how to override it. Items marked ✓ are shipped.
   change). **The backend is VM-verified** (a full BTRFS+LUKS install: both
   `root`+`home` configs, a `/home` timeline snapshot taken, `/home/.snapshots`
   a real subvolume, the oneshot `Result=success`).
-  - ⚠ **Known bug — btrfs-assistant 2.2 segfaults on launch** in nixpkgs
-    26.05: it crashes inside `libbtrfsutil.so.1.4.0` (a library ABI mismatch,
-    confirmed in the VM regardless of GL/Qt platform — so it's not a VM/GL
-    artifact and will crash on hardware too). The menu wiring is correct and
-    the app is installed, but the GUI doesn't open. The snapshot *backend*
-    (the actual snapshots) is unaffected. Fix path: a nixpkgs override aligning
-    its libbtrfsutil, or wait for an upstream bump. ✓ **Fallback shipped:**
+  - ✓ **Resolved — the "btrfs-assistant 2.2 segfault" was unprivileged-only**
+    (re-diagnosed 2026-07-04): gdb puts the crash in `btrfs_util_subvolume_
+    iterator_next()` — libbtrfsutil's *unprivileged* subvolume-iteration path
+    in btrfs-progs 6.17.1 (upstream-fixed after 6.17.1, kdave/btrfs-progs
+    `886571653` "re-enable tree search v2 ioctl"; symbol versions were checked
+    and match, so not an ABI/link issue). **As root it runs fine** — VM-proven
+    (root `--version` exits 0, unprivileged exits 139) — and the pkexec
+    launcher runs it as root, so the GUI was never actually broken *when
+    launched right*. What WAS missing distro-wide: **no polkit authentication
+    agent**, so every pkexec prompt in the session failed silently — that's
+    the root cause of "the GUI doesn't open". Fixes: `hyprpolkitagent`
+    (Hyprland's Qt agent, Stylix-themed) now ships via exec-once in
+    `hyprland.nix`; the menu prefers `btrfs-assistant-launcher` again with
+    `nomarchy-snapshots` as fallback; `checks.snapshot-gui` guards the root
+    path on a real btrfs volume (and the GUI event loop offscreen) against
+    lock-bump regressions. No btrfs-progs patch: our flows are all root-side,
+    so the unprivileged fix rides in with a future lock bump. Original
+    diagnosis kept below for the record. ✓ **Fallback shipped:**
     the menu now launches `nomarchy-snapshots` (system-side, gated on
     `nomarchy.system.snapper`) instead — a keyboard-driven snapper
     browser/restore with no btrfs-assistant dependency. snapper is root-only