scripts: Prompt polkit for GUI grok-bot auto-update

Desktop Exec=grok-bot has no TTY, so interactive sudo cannot
prompt and auto-update is skipped. Try sudo -n, then pkexec of a
grok-bot-bin-only helper (auth_admin, not NOPASSWD), then
interactive sudo on a TTY. Cancel or deny still launches the
installed binary.

#16

pkexec-pacman-u

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Root helper for grok-bot-bin GUI auto-update. Invoked via pkexec only.
+# Runs pacman -U on a local grok-bot-bin package — not a generic pacman wrapper.
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+  echo "pkexec-pacman-u: usage: pkexec-pacman-u /path/to/grok-bot-bin-*-x86_64.pkg.tar.zst" >&2
+  exit 2
+fi
+
+pkg=$1
+if [[ "$pkg" != /* || "$pkg" == *..* ]]; then
+  echo "pkexec-pacman-u: refusing path: $pkg" >&2
+  exit 2
+fi
+
+base=$(basename -- "$pkg")
+if [[ ! "$base" =~ ^grok-bot-bin-.+-x86_64\.pkg\.tar\.zst$ ]]; then
+  echo "pkexec-pacman-u: refusing package name: $base" >&2
+  exit 2
+fi
+
+if [[ ! -f "$pkg" || ! -r "$pkg" ]]; then
+  echo "pkexec-pacman-u: package not found or unreadable: $pkg" >&2
+  exit 2
+fi
+
+# Filename is not enough; require the package metadata name.
+info=$(/usr/bin/pacman -Qp -- "$pkg" 2>/dev/null) || {
+  echo "pkexec-pacman-u: not a pacman package: $pkg" >&2
+  exit 2
+}
+name=${info%% *}
+if [[ "$name" != grok-bot-bin ]]; then
+  echo "pkexec-pacman-u: refusing package $name" >&2
+  exit 2
+fi
+
+exec /usr/bin/pacman -U --noconfirm -- "$pkg"