---
Since boot, I had logged in, then later logged out, logged in again, suspended, and this morning I resumed the system and that's when I noticed the problem.

I spotted that there was a 2nd 'gnome-shell' process busy-looping -- not the one from my current session -- and killed it (sorry, didn't look to see what it was doing). At that point I saw:

Apr 04 09:27:16 rubik polkitd[11872]: Unregistered Authentication Agent for unix-session:1 (system bus name :1.80, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_GB.utf8) (disconnected from bus)

The VPN password dialog still wouldn't work of course: I had to use Alt-F2 and 'r' to reload the shell in order for it to re-register as an authentication agent.

Once I'd done this, it worked fine again.
---

Since NM only allows one name+UID to register as an agent at the same time, the hung gnome-shell prevented the working gnome-shell from registering.  Then, when the first gnome-shell was killed, the working gnome-shell had no idea it could re-register.  Obviously a bug in gnome-shell caused the first one to hang, but we can do better.

We could add a signal to the NM Agent interface that is emitted a second or two after any agent quits, which unregistered agents (like the working gnome-shell) could listen for and attempt to re-register.  We'd want to rate-limit this signal (thus the delay, and also to prevent re-registration races) but it would solve this particular issue and provide a better experience for users.