[feat] Add Touch ID unlock for guest 1Password

[Fail-Safe]

What changes

Adds opt-in Mac Touch ID unlock for 1Password running inside the Linux guest. A locked desktop app or connected browser extension requests system authentication, the focused VM shows a dedicated Mac Touch ID prompt, and the signed approval unlocks guest 1Password. Vaults and passkeys remain managed by guest 1Password; no host password manager or passkey forwarding is required.

Canceling or failing Touch ID opens a compact floating guest-password dialog using the standard polkit PAM session. The 1Password account-password option remains available. Setup reuses existing Touch ID enrollment and requires both an updated host helper and the explicit guest installer documented in docs/onepassword-touch-id.md.

Authorization and lifecycle

• Adds a distinct signed onepassword-unlock operation bound to the exact 1Password unlock service and guest identity. Existing sudo requests retain their validation rules.
• Registers a root-owned polkit agent only for verified installed 1Password processes in the active local guest session. Checks executable ownership, UID, process start time, current polkit sender, cancellation, and session state. Other desktop processes retain their existing authentication agents.
• Keeps passwords in an unprivileged GTK dialog backed by PolkitAgent.Session. A successful dialog exit alone cannot authorize a request. Other 1Password actions use the PAM path.
• Serializes the shared authentication device so simultaneous requests cannot consume each other's responses. Does not install blanket polkit authorization rules or change PAM policy.
• Preserves launcher socket directories when process inspection fails or either recorded process is still alive. This prevents cleanup from severing native bridges during a running VM; isolated regression fixtures cover unavailable process inspection and live/stale processes.

Validation

• Full make test on the current upstream base, including signed request separation, replay/expiry checks, polkit caller validation, cancellation, fallback, and launcher cleanup coverage.
• Release Swift helper build.
• Earlier local app packaging passed deep/strict code-signature verification; the installed feature was exercised with an existing persistent guest.
• Live user-confirmed checks: desktop Touch ID unlock, Firefox extension Touch ID unlock, selection of a 1Password passkey and successful website sign-in, and canceled Touch ID followed by successful guest-password unlock in the compact floating dialog.
• The fallback honors the guest's normal password lockout policy; the setup guide includes diagnosis for temporary lockouts.

The live app used an existing integrated local build. The PR is rebased onto current upstream main and tested separately. A fresh factory guest image and QEMU runtime rebuild are not part of this validation.