Wire action-group variables, sudo, and command path resolution through the API and UI.

Completes run-if/set_variable and requires_sudo editing, sudoers path resolve helpers, and execute permission checks so node action groups can gate upgrades and elevate safely.

service/internal/api/setup_auth_handlers.go

@@ -511,6 +511,7 @@ func allPermissionList() []string {
 		"actions.create",
 		"actions.update",
 		"actions.delete",
+		"actions.execute",
 		"users.manage",
 		"secrets.manage",
 		"roles.manage",
@@ -540,7 +541,14 @@ func loadSettingsOrDefault(configDir string) (settings.Settings, error) {
 		payload.Groups = []settings.Group{}
 	}
 	payload.Network = settings.EffectiveNetwork(payload.Network)
+	changed := false
 	if migrateLogsReadPermission(&payload) {
+		changed = true
+	}
+	if migrateActionsExecutePermission(&payload) {
+		changed = true
+	}
+	if changed {
 		if err := settings.SaveSettings(configDir, payload); err != nil {
 			return settings.Settings{}, err
 		}
@@ -572,3 +580,28 @@ func migrateLogsReadPermission(payload *settings.Settings) bool {
 	}
 	return changed
 }
+
+// migrateActionsExecutePermission grants actions.execute to groups that
+// previously could run actions via jobs.run. Returns true when settings changed.
+func migrateActionsExecutePermission(payload *settings.Settings) bool {
+	changed := false
+	for index := range payload.Groups {
+		group := &payload.Groups[index]
+		hasActionsExecute := false
+		hasJobsRun := false
+		for _, permission := range group.Permissions {
+			switch permission {
+			case "actions.execute":
+				hasActionsExecute = true
+			case "jobs.run":
+				hasJobsRun = true
+			}
+		}
+		if hasActionsExecute || !hasJobsRun {
+			continue
+		}
+		group.Permissions = append(group.Permissions, "actions.execute")
+		changed = true
+	}
+	return changed
+}