PackageKit skips the polkit check for transactions carrying SIMULATE (dry-run). The
dnf5 backend's REPO_REMOVE handler nevertheless always runs the real transaction,
because the guard is written as (role == REPO_REMOVE || !SIMULATE) — always true for
that role. An unprivileged client can therefore perform a genuine uninstall while
claiming to simulate.