Add targeted Gufw compatibility for Sway sessions

- Remove the global xhost call from start-sway-session to keep Wayland startup clean
- Add a dedicated gufw wrapper and desktop override that temporarily grants Xwayland access only for gufw

dotfiles/desktop/.local/bin/start-sway-session

@@ -24,6 +24,5 @@ exec dbus-run-session sh -eu -c '
   printf "%s\n" "$DBUS_SESSION_BUS_ADDRESS" > "$HOME/.dbus-session-bus-address"
   gpgconf --launch gpg-agent
   "$HOME/.local/bin/update-turnstile-env"
-  xhost +local:
   exec "$@"
 ' sh "$@"