Wire action-group variables, sudo, and command path resolution through the API and UI.

Completes run-if/set_variable and requires_sudo editing, sudoers path resolve helpers, and execute permission checks so node action groups can gate upgrades and elevate safely.

service/internal/api/auth_audit_test.go

@@ -201,6 +201,31 @@ func TestMigrateLogsReadPermission(t *testing.T) {
 	}
 }
 
+func TestMigrateActionsExecutePermission(t *testing.T) {
+	payload := settings.Settings{
+		Groups: []settings.Group{
+			{Name: "runners", Permissions: []string{"jobs.run", "nodes.read"}},
+			{Name: "already", Permissions: []string{"jobs.run", "actions.execute"}},
+			{Name: "viewers", Permissions: []string{"jobs.read"}},
+		},
+	}
+	if !migrateActionsExecutePermission(&payload) {
+		t.Fatal("expected migration to change settings")
+	}
+	if !containsPermission(payload.Groups[0].Permissions, "actions.execute") {
+		t.Fatal("runners should gain actions.execute from jobs.run")
+	}
+	if len(payload.Groups[1].Permissions) != 2 {
+		t.Fatal("already should be unchanged")
+	}
+	if containsPermission(payload.Groups[2].Permissions, "actions.execute") {
+		t.Fatal("viewers should not gain actions.execute")
+	}
+	if migrateActionsExecutePermission(&payload) {
+		t.Fatal("second migration should be a no-op")
+	}
+}
+
 func containsPermission(permissions []string, wanted string) bool {
 	for _, permission := range permissions {
 		if permission == wanted {