Add targeted Gufw compatibility for Sway sessions

- Remove the global xhost call from start-sway-session to keep Wayland startup clean
- Add a dedicated gufw wrapper and desktop override that temporarily grants Xwayland access only for gufw

ansible/inventory/group_vars/desktop.yml

@@ -66,8 +66,8 @@ desktop_sway_packages:
   - slurp
   - swayfx
   - wl-clipboard
-  - xdg-desktop-portal-wlr
   - xhost
+  - xdg-desktop-portal-wlr
   - xorg-server-xwayland
 
 profile_packages:
@@ -247,10 +247,18 @@ desktop_common_dotfiles:
     src: .local/bin/update-turnstile-env
     dest: .local/bin/update-turnstile-env
     mode: "0755"
+  - name: Gufw Sway wrapper
+    src: .local/bin/run-gufw
+    dest: .local/bin/run-gufw
+    mode: "0755"
   - name: Udiskie password helper
     src: .local/bin/udiskie-password
     dest: .local/bin/udiskie-password
     mode: "0755"
+  - name: Desktop application overrides
+    src: .local/share/applications/
+    dest: .local/share/applications/
+    mode: preserve
   - name: SSH config
     src: .ssh/config
     dest: .ssh/config