Wire action-group variables, sudo, and command path resolution through the API and UI.

Completes run-if/set_variable and requires_sudo editing, sudoers path resolve helpers, and execute permission checks so node action groups can gate upgrades and elevate safely.

service/internal/api/authz.go

@@ -14,6 +14,7 @@ var errNodesDeleteRequired = errors.New("permission nodes.delete required")
 var errActionsCreateRequired = errors.New("permission actions.create required")
 var errActionsUpdateRequired = errors.New("permission actions.update required")
 var errActionsDeleteRequired = errors.New("permission actions.delete required")
+var errActionsExecuteRequired = errors.New("permission actions.execute required")
 var errJobsRunRequired = errors.New("permission jobs.run required")
 var errLogsReadRequired = errors.New("permission logs.read required")
 
@@ -162,6 +163,10 @@ func authorizeActionsDelete(request *http.Request, configDir string) error {
 	return authorizeNamedPermission(request, configDir, "actions.delete", errActionsDeleteRequired)
 }
 
+func authorizeActionsExecute(request *http.Request, configDir string) error {
+	return authorizeNamedPermission(request, configDir, "actions.execute", errActionsExecuteRequired)
+}
+
 func (app *App) authorizeJobsRun(request *http.Request) error {
 	user, ok := UserFromContext(request.Context())
 	if !ok {