Add targeted Gufw compatibility for Sway sessions

- Remove the global xhost call from start-sway-session to keep Wayland startup clean
- Add a dedicated gufw wrapper and desktop override that temporarily grants Xwayland access only for gufw

dotfiles/desktop/.local/bin/run-gufw

@@ -0,0 +1,22 @@
+#!/usr/bin/env sh
+
+set -eu
+
+if [ -z "${DISPLAY:-}" ]; then
+  printf 'Error: DISPLAY is not set; cannot launch gufw under Xwayland.\n' >&2
+  exit 1
+fi
+
+if ! command -v xhost >/dev/null 2>&1; then
+  printf 'Error: xhost is required to launch gufw from a Wayland session.\n' >&2
+  exit 1
+fi
+
+cleanup() {
+  xhost -si:localuser:root >/dev/null 2>&1 || true
+}
+
+trap cleanup EXIT INT TERM HUP
+
+xhost si:localuser:root >/dev/null
+exec gufw "$@"