desktop: write an xauth entry for :1 once Xvfb is up

[CMGS]

What

The desktop flavor installs an empty /home/user/.Xauthority so python-xlib finds the file. python-xlib does not stop there: it looks the display up by hostname and display number, finds no entry, and prints two Xlib.xauth: warning, no xauthority details available lines on stdout every time pyautogui is imported.

The guest's osworld-server runs grader code as python -c "<pyautogui prefix>; …" and hands that stdout back to the harness. A getter that json-decodes it (get_vm_file_with_wildcard) fails, logs Failed to parse glob results … Expecting value: line 1 column 1, and reports no files. Two OSWorld-V2 tasks (028, 091) scored as failures on this image although the agent had produced the files; the same tasks pass on an AMI with a populated Xauthority.

This adds an ExecStartPost to xvfb.service that writes an entry for :1 once the socket exists. The cookie value is irrelevant (Xvfb runs with -ac); the entry only has to exist. Guest hostname is a stable localhost after restore, so a golden-time entry serves every clone.

Evidence

Exact line run as root in a live guest, then the harness's own payload through the osworld-server:

runuser -u user -- xauth -f /home/user/.Xauthority add :1 . $(mcookie); echo rc=$?
rc=0
localhost/unix:1  MIT-MAGIC-COOKIE-1  0378507e…

POST /execute {"command":["python","-c","<PYAUTOGUI_PKGS_PREFIX>; import glob; import json; print(json.dumps(glob.glob('/home/user/Downloads/*.json')))"]}
before: stdout 'Xlib.xauth: warning, no xauthority details available\nXlib.xauth: warning, …\n["/home/user/Downloads/Meningococcal-Basic_1.json"]'
after:  stdout '[]'   (no warning)

Image built with this change and gated in a cold-booted guest (python modules, DISPLAY :0 alias, evolution store, zotero path, keyring off, snap shim, wine/dxvk, fanotify, port relay, and a new check that import pyautogui through the server prints nothing but the payload): OVERLAY_GATE PASS.

Hot path: none; one xauth add at Xvfb start.