Letting an unprivileged panel ask root for an update
How Cat-AgentUI's System update page works when the code belongs to root and the service runs as its own user: the panel can only drop one short line into an inbox, and a root helper decides what that line is allowed to mean.