CI / Build & Test (push) Successful in 3m37s
- Replace sudo with pkexec so PolicyKit shows a graphical auth dialog when the native host is launched by the browser (no terminal). - Pass DISPLAY and XAUTHORITY into the pkexec env so the polkit agent can display the dialog in the current session. - Keep copy + update-ca-certificates in a single pkexec sh -c for one password prompt. - Update SECURITY.md and JSDoc to describe pkexec / PolicyKit.