The policykit binaries on Debian live in /usr/lib/policykit so add file contexts for that. Also a couple of policykit rules.