- Remove the global xhost call from start-sway-session to keep Wayland startup clean - Add a dedicated gufw wrapper and desktop override that temporarily grants Xwayland access only for gufw