Wire action-group variables, sudo, and command path resolution through the API and UI.

Completes run-if/set_variable and requires_sudo editing, sudoers path resolve helpers, and execute permission checks so node action groups can gate upgrades and elevate safely.

service/internal/api/actions_handlers.go

@@ -17,18 +17,20 @@ type actionsResponse struct {
 }
 
 type createActionRequest struct {
-	Name        string                  `json:"name"`
-	Description string                  `json:"description"`
-	Kind        settings.ActionKind     `json:"kind"`
-	Body        string                  `json:"body"`
-	Env         []settings.ActionEnvVar `json:"env"`
+	Name         string                  `json:"name"`
+	Description  string                  `json:"description"`
+	Kind         settings.ActionKind     `json:"kind"`
+	Body         string                  `json:"body"`
+	Env          []settings.ActionEnvVar `json:"env"`
+	RequiresSudo bool                    `json:"requires_sudo"`
 }
 
 type patchActionRequest struct {
-	Name        *string                  `json:"name"`
-	Description *string                  `json:"description"`
-	Body        *string                  `json:"body"`
-	Env         *[]settings.ActionEnvVar `json:"env"`
+	Name         *string                  `json:"name"`
+	Description  *string                  `json:"description"`
+	Body         *string                  `json:"body"`
+	Env          *[]settings.ActionEnvVar `json:"env"`
+	RequiresSudo *bool                    `json:"requires_sudo"`
 }
 
 var envVarNamePattern = regexp.MustCompile(`^[A-Za-z_][A-Za-z0-9_]*$`)
@@ -136,6 +138,9 @@ func actionsPatchHandler(configDir string) http.HandlerFunc {
 		if payload.Env != nil {
 			updated.Env = *payload.Env
 		}
+		if payload.RequiresSudo != nil {
+			updated.RequiresSudo = *payload.RequiresSudo
+		}
 		updated.UpdatedAt = time.Now().UTC()
 
 		if err := validateActionFields(updated.Name, updated.Kind, updated.Body, updated.Env); err != nil {
@@ -215,15 +220,16 @@ func buildCustomAction(payload createActionRequest) (settings.Action, error) {
 
 	now := time.Now().UTC()
 	return settings.Action{
-		ID:          actionID,
-		Name:        name,
-		Description: description,
-		Kind:        payload.Kind,
-		Body:        body,
-		Env:         env,
-		Builtin:     false,
-		CreatedAt:   now,
-		UpdatedAt:   now,
+		ID:           actionID,
+		Name:         name,
+		Description:  description,
+		Kind:         payload.Kind,
+		Body:         body,
+		Env:          env,
+		RequiresSudo: payload.RequiresSudo,
+		Builtin:      false,
+		CreatedAt:    now,
+		UpdatedAt:    now,
 	}, nil
 }