Add PolicyKit policy configuration that authorizes gameboot launchers (desktop entries) to execute /usr/local/bin/fws-gameboot via pkexec.
The policy allows active users (physically present) to switch to Windows without password prompt since the switch is non-destructive (FWS hibernates and restores the session on return). Remote or inactive sessions require admin authentication.
