POSIX sh helper (pkexec target) that mounts/unmounts CIFS shares with strict
validation of the unprivileged caller's arguments: mountpoint confined to
$HOME or /run/media/<user>, //host/share source, credfile under the caller's
runtime dir at mode 0600, whitelisted SMB version/options/modes. Polkit
action authorizes it with auth_admin_keep.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Jaroslav Beneš