workspace: add bread-app crate and first-cut bread-polkit agent

bread-app is the GTK bootstrap new tools should use instead of another
copied main.rs: com.breadway.* app id, singleton lock, optional
gtk_popup re-export, optional bread.command.<app>.** listen loop.
Tests cover app-id helpers and command-verb parse. Existing apps are
not migrated.

bread-polkit is an own PolicyKit1 session authentication agent with a
bread-theme GTK4 password prompt (not a polkit-gnome wrapper).
Autostart via contrib/bread-polkit.desktop or exec-once. Not a bakery
product; not added to the BOS ISO lockfile.

bread-polkit/contrib/bread-polkit.desktop

@@ -0,0 +1,12 @@
+[Desktop Entry]
+Type=Application
+Name=Bread PolicyKit Agent
+Comment=Themed PolicyKit authentication agent for the bread desktop
+Exec=bread-polkit
+Icon=dialog-password
+Terminal=false
+Categories=System;Security;
+StartupNotify=false
+X-GNOME-Autostart-Phase=Initialization
+X-GNOME-AutoRestart=true
+X-GNOME-Autostart-Notify=false

bread-polkit/contrib/hyprland.conf

@@ -0,0 +1,10 @@
+# bread-polkit — add to hyprland.conf
+#
+# Session authentication agent. Copy contrib/bread-polkit.desktop to
+# ~/.config/autostart/ instead if you prefer XDG autostart.
+
+exec-once = bread-polkit
+
+# Optional: blur the overlay panel (namespace is bread-polkit).
+layerrule = blur, bread-polkit
+layerrule = ignorezero, bread-polkit