WSLg apps: XDG_SESSION_CLASS env + localsearch-3 system-UID drop-in

Two coupled fixes for GTK app dbus chain on WSLg dev VM:

1. mios-wsl-env-import.service: also push XDG_SESSION_CLASS=user
   into the systemd user-bus + dbus activation environment.
   localsearch-3.service (the renamed tracker3 indexer in Fedora 44)
   has ConditionEnvironment=XDG_SESSION_CLASS=user. WSLg has no
   display manager to set it, so the unit fails activation, dbus
   returns ServiceUnknown for org.freedesktop.Tracker3.Miner.Files,
   GTK apps querying SPARQL null-deref in their bookmark loader.

2. /etc/systemd/user/localsearch-3.service.d/10-mios-allow-system-uid.conf
   (NEW drop-in, also applied to .control + .writeback siblings):
   nullifies the upstream ConditionUser=!@System. MiOS dev VM
   creates the mios user at UID 992 (system class, 0-999). Without
   this drop-in, localsearch-3 still skips even with XDG_SESSION_CLASS
   set because the user fails the @System check too.

   This is a workaround. The proper fix is to create the mios user
   with UID >= 1000 at install time (mios-bootstrap useradd -u 1000)
   so the upstream condition naturally passes. Until that's wired up,
   the drop-in keeps the dbus chain alive.

.gitignore: added allowlist entries for
/etc/systemd/user/<upstream-unit>.service.d/10-mios-*.conf so future
drop-ins targeting upstream units don't get silently dropped by
the etc/* deny pattern.

Operator-confirmed live 2026-05-10:
  - localsearch-3.service: inactive -> active after the two fixes
  - org.freedesktop.Tracker3.Miner.Files dbus activation now succeeds
  - org.freedesktop.portal.Tracker (tinysparql-xdg-portal-3.service) active

Known gap NOT solved by this commit: nautilus flatpak STILL crashes
on the SPARQL backend lookup despite all the host-side services
being up. The flatpak's bundled libtracker-sparql is making a
different dbus call that the proxy filters out even with talk
permissions added to org.freedesktop.Tracker3.Miner.Files +
org.freedesktop.LocalSearch3 + org.freedesktop.portal.Tracker.
gnome-software (system pkg, not flatpak) survives and renders fine.
nautilus needs deeper flatpak-side investigation (possibly the
runtime's tracker3 protocol version mismatch with host service).

Author: Kabuki94

.gitignore

@@ -152,6 +152,15 @@ etc/fapolicyd/*
 !/etc/xdg/
 !/etc/xdg/**
 
+# /etc/systemd/user/<upstream-unit>.service.d/ -- drop-in overrides for
+# upstream-shipped systemd user units (localsearch-3 et al.). Drop-in
+# files MUST be named with the mios- prefix so they're distinguishable
+# from operator-authored overrides at /etc/systemd/user/<unit>.d/.
+!/etc/systemd/
+!/etc/systemd/user/
+!/etc/systemd/user/**/
+!/etc/systemd/user/**/10-mios-*.conf
+
 # /etc/mios/ -- KB config (system-prompts, kb.conf.toml, eval-criteria.json) tracked here.
 # Runtime secrets and per-host overrides are NOT tracked (handled by mios-bootstrap.git).
 !/etc/mios/

etc/systemd/user/localsearch-3.service.d/10-mios-allow-system-uid.conf

@@ -0,0 +1,15 @@
+# /etc/systemd/user/localsearch-3.service.d/10-mios-allow-system-uid.conf
+#
+# MiOS dev VM creates the `mios` user with UID 992 (system class
+# range, 0-999). Upstream localsearch-3 has ConditionUser=!@system
+# so it refuses to start for system users. Without this drop-in,
+# nautilus + gnome-files dbus-activate Tracker3.Miner.Files,
+# localsearch-3 fails the condition check, dbus returns
+# ServiceUnknown, the GTK app null-derefs in its bookmark loader.
+#
+# Future: ideally the mios user gets UID 1000+ at install time
+# (mios-bootstrap useradd -u 1000) and this drop-in becomes
+# unnecessary. Until then this is the live workaround.
+[Unit]
+ConditionUser=
+

etc/systemd/user/localsearch-control-3.service.d/10-mios-allow-system-uid.conf

@@ -0,0 +1,15 @@
+# /etc/systemd/user/localsearch-3.service.d/10-mios-allow-system-uid.conf
+#
+# MiOS dev VM creates the `mios` user with UID 992 (system class
+# range, 0-999). Upstream localsearch-3 has ConditionUser=!@system
+# so it refuses to start for system users. Without this drop-in,
+# nautilus + gnome-files dbus-activate Tracker3.Miner.Files,
+# localsearch-3 fails the condition check, dbus returns
+# ServiceUnknown, the GTK app null-derefs in its bookmark loader.
+#
+# Future: ideally the mios user gets UID 1000+ at install time
+# (mios-bootstrap useradd -u 1000) and this drop-in becomes
+# unnecessary. Until then this is the live workaround.
+[Unit]
+ConditionUser=
+

etc/systemd/user/localsearch-writeback-3.service.d/10-mios-allow-system-uid.conf

@@ -0,0 +1,15 @@
+# /etc/systemd/user/localsearch-3.service.d/10-mios-allow-system-uid.conf
+#
+# MiOS dev VM creates the `mios` user with UID 992 (system class
+# range, 0-999). Upstream localsearch-3 has ConditionUser=!@system
+# so it refuses to start for system users. Without this drop-in,
+# nautilus + gnome-files dbus-activate Tracker3.Miner.Files,
+# localsearch-3 fails the condition check, dbus returns
+# ServiceUnknown, the GTK app null-derefs in its bookmark loader.
+#
+# Future: ideally the mios user gets UID 1000+ at install time
+# (mios-bootstrap useradd -u 1000) and this drop-in becomes
+# unnecessary. Until then this is the live workaround.
+[Unit]
+ConditionUser=
+

usr/lib/systemd/user/mios-wsl-env-import.service

@@ -26,8 +26,19 @@ After=basic.target
 
 [Service]
 Type=oneshot
-ExecStart=/usr/bin/systemctl --user import-environment XDG_CURRENT_DESKTOP WAYLAND_DISPLAY DISPLAY XDG_SESSION_TYPE XDG_RUNTIME_DIR PULSE_SERVER
-ExecStart=/usr/bin/dbus-update-activation-environment --systemd XDG_CURRENT_DESKTOP WAYLAND_DISPLAY DISPLAY XDG_SESSION_TYPE XDG_RUNTIME_DIR PULSE_SERVER
+# XDG_SESSION_CLASS=user is required by localsearch-3 (the renamed
+# tracker3 indexer) and several other GNOME services that gate on
+# being a real "user" session. WSLg has no display manager to set
+# it; without it, dbus activation of org.freedesktop.Tracker3.Miner.Files
+# fails with "unit failed", nautilus then crashes on the SPARQL
+# backend ServiceUnknown error -> GLib G_IS_OBJECT assertion.
+# Operator-confirmed 2026-05-10 via journalctl --user -u
+# localsearch-3.service: "skipped, unmet condition check
+# ConditionEnvironment=XDG_SESSION_CLASS=user".  Force-setting it
+# here unblocks the whole chain.
+ExecStart=/usr/bin/systemctl --user set-environment XDG_SESSION_CLASS=user
+ExecStart=/usr/bin/systemctl --user import-environment XDG_CURRENT_DESKTOP WAYLAND_DISPLAY DISPLAY XDG_SESSION_TYPE XDG_SESSION_CLASS XDG_RUNTIME_DIR PULSE_SERVER
+ExecStart=/usr/bin/dbus-update-activation-environment --systemd XDG_CURRENT_DESKTOP WAYLAND_DISPLAY DISPLAY XDG_SESSION_TYPE XDG_SESSION_CLASS XDG_RUNTIME_DIR PULSE_SERVER
 RemainAfterExit=yes
 
 [Install]