Let the password prompt say why

panama-sudo is pkexec with a stated reason: the reason travels to the
shell over the existing polkit IPC target, and the prompt renders it
labeled "Stated reason (unverified)" beside polkitd's real action
message -- beside, never instead of, because any process can claim any
reason and the action text is the trust anchor. Reasons are single-shot
and expire in ten seconds, so a stale one cannot dress up an unrelated
prompt; without a reason, a running shell, or qs the wrapper is exactly
pkexec. Built for agents, so the person typing their password learns
what for. Verified live end to end -- reason shown, consumed once,
expired when stale, cleared on dismissal -- and pinned by the polkit
reason contract.

bin/panama-sudo

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# pkexec, with a stated reason on the password prompt.
+#
+#   panama-sudo --reason "Installing gamemode hooks" -- dnf install gamemode
+#
+# The reason travels to the shell over Quickshell IPC before pkexec runs, and
+# Panama's prompt shows it clearly labeled beside polkitd's own action message
+# -- beside, never instead of: anything can claim any reason, so the real
+# action text stays the trust anchor. Meant for agents and scripts, so the
+# person at the keyboard learns WHY before typing their password.
+#
+# Degrades to plain pkexec: no --reason, no running shell, or no qs on PATH
+# all behave identically to calling pkexec yourself.
+
+set -euo pipefail
+
+reason=""
+if [[ "${1:-}" == "--reason" ]]; then
+  reason="${2:?panama-sudo: --reason needs a value}"
+  shift 2
+fi
+[[ "${1:-}" == "--" ]] && shift
+
+if (( $# == 0 )); then
+  echo 'usage: panama-sudo [--reason "why"] -- command [args...]' >&2
+  exit 2
+fi
+
+if [[ -n "$reason" ]] && command -v qs >/dev/null 2>&1; then
+  qs ipc call polkit reason "$reason" >/dev/null 2>&1 || true
+fi
+
+exec pkexec "$@"