bread-polkit: only auth as an identity polkit actually offered; fail fast without the lock

- The agent prompt's username field is user-editable. It was passed
  straight to `auth::authenticate`, so a request scoped to specific
  accounts (e.g. root only) could have its PAM conversation redirected
  to any local user. `resolve_user` now accepts only the `unix-user`
  identities from `BeginAuthentication` (empty = the prefilled default);
  anything else re-shows the prompt with an explanation. PAM still has to
  clear polkit's own authorization, but this closes the foot-gun at the
  one place the identity list is known.
- A failed single-instance lock now exits(1) instead of continuing: a
  second agent would `serve_at` the same object path, and a prompt held
  by a process that couldn't take the lock is ambiguous state.

bread-polkit/src/main.rs

@@ -50,8 +50,13 @@ fn main() {
             std::process::exit(0);
         }
         Err(e) => {
-            eprintln!("bread-polkit: singleton lock unavailable ({e}); continuing");
-            None
+            // Don't keep running without the single-instance lock: a second
+            // copy would attempt to `serve_at` the same PolicyKit agent
+            // object path on the system bus, and a password prompt held by a
+            // process whose lock couldn't be taken is ambiguous state. Fail
+            // fast and let a wrapper/autostart retry.
+            eprintln!("bread-polkit: singleton lock unavailable ({e}); exiting");
+            std::process::exit(1);
         }
     };