scripts: Prompt polkit for GUI grok-bot auto-update

Desktop Exec=grok-bot has no TTY, so interactive sudo cannot
prompt and auto-update is skipped. Try sudo -n, then pkexec of a
grok-bot-bin-only helper (auth_admin, not NOPASSWD), then
interactive sudo on a TTY. Cancel or deny still launches the
installed binary.

#16

grok-bot-launch.sh

@@ -5,6 +5,43 @@ set -u
 
 REAL_DIR="/opt/Grok Bot"
 API_URL='https://git.s1d3sw1ped.com/api/v1/repos/s1d3sw1ped/grok-bot-bin/releases?limit=1'
+PKEXEC_HELPER=/usr/lib/grok-bot-bin/pkexec-pacman-u
+
+# Privilege order for pacman -U:
+#   1. sudo -n          (NOPASSWD, e.g. lab CT113)
+#   2. pkexec           (graphical polkit; desktop Exec=grok-bot has no TTY)
+#   3. interactive sudo (terminal TTY)
+# Never default to passwordless sudo. Cancel/deny still launches the installed binary.
+_install_update_pkg() {
+  local pkg=$1
+
+  if sudo -n true 2>/dev/null; then
+    if sudo -n pacman -U --noconfirm "$pkg"; then
+      return 0
+    fi
+    echo "grok-bot: pacman -U failed; launching installed version" >&2
+    return 1
+  fi
+
+  if [[ ! -t 0 ]] && command -v pkexec >/dev/null 2>&1 && [[ -x "$PKEXEC_HELPER" ]] \
+    && [[ -n "${DISPLAY:-}${WAYLAND_DISPLAY:-}" ]]; then
+    if pkexec --disable-internal-agent "$PKEXEC_HELPER" "$pkg"; then
+      return 0
+    fi
+    echo "grok-bot: polkit auth failed or cancelled; launching installed version" >&2
+    return 1
+  fi
+
+  if [[ -t 0 ]]; then
+    if sudo pacman -U --noconfirm "$pkg"; then
+      return 0
+    fi
+  fi
+
+  echo "grok-bot: need sudo or polkit to auto-update; run: sudo pacman -U <pkg> or launch /usr/bin/grok-bot from a terminal" >&2
+  echo "grok-bot: pacman -U failed; launching installed version" >&2
+  return 1
+}
 
 _maybe_update() {
   [[ "${GROK_BOT_NO_UPDATE:-}" == "1" ]] && return 0
@@ -50,14 +87,7 @@ _maybe_update() {
     return 0
   fi
 
-  # Prefer passwordless sudo; fall back to interactive sudo. Fail soft either way.
-  if ! sudo -n pacman -U --noconfirm "$pkg" 2>/dev/null; then
-    if ! sudo pacman -U --noconfirm "$pkg"; then
-      echo "grok-bot: need sudo to auto-update; run: sudo pacman -U <pkg> or launch /usr/bin/grok-bot from a terminal" >&2
-      echo "grok-bot: pacman -U failed; launching installed version" >&2
-      return 0
-    fi
-  fi
+  _install_update_pkg "$pkg" || return 0
 }
 
 _maybe_update || true