session: ~/.password-store is a dir
gpg.cil: rules related to adding a key with pass

most of these rules are for gpg2keys_hkp, may be better to run that
util with a domain transition instead.

regardless, gpg itself still also needs to be associated with
auth_nsswitch_client_subject and needs to "self rw_fifo_file_perms"