run_auth_dialog now returns a thread-safe dismiss callable so polkitd
cancellations can close the dialog from any thread. connect_sysauth_service
wires the agent signals to the dialog: show on begin, respond on submit,
re-prompt on failure, dismiss on cancel.