scripts: Prompt polkit for GUI grok-bot auto-update

Desktop Exec=grok-bot has no TTY, so interactive sudo cannot
prompt and auto-update is skipped. Try sudo -n, then pkexec of a
grok-bot-bin-only helper (auth_admin, not NOPASSWD), then
interactive sudo on a TTY. Cancel or deny still launches the
installed binary.

#16

PKGBUILD

@@ -10,7 +10,7 @@
 pkgname=grok-bot-bin
 pkgver=0.39.0
 _commit=d8bc9c753edddb313047c9c69b480b7f8f321087
-pkgrel=1
+pkgrel=2
 pkgdesc="Grok Bot desktop agent (official .deb repackaged)"
 arch=('x86_64')
 url="https://cursor.com/download/bot"
@@ -32,6 +32,7 @@ depends=(
 optdepends=(
   'libappindicator-gtk3: tray icon support'
   'curl: auto-update check on launch'
+  'polkit: graphical password prompt for desktop auto-update (pkexec)'
 )
 provides=('grok-bot' 'sand')
 conflicts=('grok-bot' 'sand')
@@ -40,11 +41,15 @@ options=('!strip' '!debug')
 source=(
   "https://downloads.cursor.com/grokbot/stable/${_commit}/linux/x64/grok-bot_${pkgver}_amd64.deb"
   "grok-bot-launch.sh"
+  "pkexec-pacman-u"
+  "com.s1d3sw1ped.grok-bot-bin.policy"
 )
 noextract=("grok-bot_${pkgver}_amd64.deb")
 sha256sums=(
   'ae498adaf71f9ff1734a786163c5807fa50165acb5aa102bb68f43ead96de4fe'
-  '1c5a3599db15816caa839fc9e088ba9798757e44fec89c066ef5f6f3c0972aee'
+  '36e1c522f7a3920a850a6235263d82ad5990611612979447c1e9eff92548ac1e'
+  'e92ea4534d864d7f302a082a8717a52af9675195af41092d18f15094f74fed45'
+  'a9533dfe4d31332ac1505d2e582eff27771dd0107108a5f6289d0d3839431a74'
 )
 
 package() {
@@ -56,6 +61,11 @@ package() {
   # Keep provides(sand) on PATH; both names run the same shim.
   ln -sf grok-bot "$pkgdir/usr/bin/sand"
 
+  # pkexec helper + polkit action (auth_admin, not NOPASSWD) for desktop auto-update.
+  install -Dm755 "$srcdir/pkexec-pacman-u" "$pkgdir/usr/lib/grok-bot-bin/pkexec-pacman-u"
+  install -Dm644 "$srcdir/com.s1d3sw1ped.grok-bot-bin.policy" \
+    "$pkgdir/usr/share/polkit-1/actions/com.s1d3sw1ped.grok-bot-bin.policy"
+
   # Always point the menu entry at the PATH shim. Upstream .desktop has used
   # Exec="/opt/Grok Bot/grok-bot" (0.30) which bypasses auto-update; rewrite
   # every build so a future /opt regression cannot ship again.