For those looking for an answer you need to add to the XML file this
<controller type='virtio-serial' index='0'/>
<target type='virtio' name='com.redhat.spice.0'/>
and install the guest, the debian package is called spice-vdagent
and reboot the ...
Having framed yesterday's frustrations more succinctly, I used a well-known search engine to look for "linux polkit local and remote sessions" and got this as the top result - Enabling system management privileges for non-local users - How the heck does polkit work, anyways? The answer (slightly modified from the linked question) is to create a ...