Let the password prompt say why

panama-sudo is pkexec with a stated reason: the reason travels to the
shell over the existing polkit IPC target, and the prompt renders it
labeled "Stated reason (unverified)" beside polkitd's real action
message -- beside, never instead of, because any process can claim any
reason and the action text is the trust anchor. Reasons are single-shot
and expire in ten seconds, so a stale one cannot dress up an unrelated
prompt; without a reason, a running shell, or qs the wrapper is exactly
pkexec. Built for agents, so the person typing their password learns
what for. Verified live end to end -- reason shown, consumed once,
expired when stale, cleared on dismissal -- and pinned by the polkit
reason contract.

config/dot/quickshell/modules/polkit/PolkitPrompt.qml

@@ -94,6 +94,34 @@ PanelWindow {
                 wrapMode: Text.WordWrap
             }
 
+            // The caller's stated reason, when panama-sudo passed one.
+            // Untrusted commentary from an unprivileged process, so it is
+            // labeled as a claim and drawn beside polkitd's message above --
+            // never in place of it. The real action text is the trust anchor.
+            Column {
+                width: parent.width
+                visible: Polkit.statedReason !== ""
+                spacing: 2
+
+                Text {
+                    text: "Stated reason (unverified)"
+                    color: Theme.fgMuted
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSizeSmall
+                    font.weight: Font.DemiBold
+                }
+
+                Text {
+                    width: parent.width
+                    text: Polkit.statedReason
+                    color: Theme.fgDim
+                    font.family: Theme.fontFamily
+                    font.pixelSize: Theme.fontSize
+                    font.italic: true
+                    wrapMode: Text.WordWrap
+                }
+            }
+
             Text {
                 width: parent.width
                 visible: Polkit.users.length > 1