Wire action-group variables, sudo, and command path resolution through the API and UI.

Completes run-if/set_variable and requires_sudo editing, sudoers path resolve helpers, and execute permission checks so node action groups can gate upgrades and elevate safely.

service/internal/auth/resolve_commands_test.go

@@ -0,0 +1,58 @@
+package auth
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestValidateCommandNames(t *testing.T) {
+	cleaned, err := ValidateCommandNames([]string{" apt ", "systemctl", "apt"})
+	if err != nil {
+		t.Fatalf("valid names: %v", err)
+	}
+	if len(cleaned) != 2 || cleaned[0] != "apt" || cleaned[1] != "systemctl" {
+		t.Fatalf("cleaned = %#v", cleaned)
+	}
+
+	if _, err := ValidateCommandNames(nil); err == nil {
+		t.Fatal("expected error for empty names")
+	}
+	if _, err := ValidateCommandNames([]string{"/usr/bin/apt"}); err == nil {
+		t.Fatal("expected error for path")
+	}
+	if _, err := ValidateCommandNames([]string{"apt;rm"}); err == nil {
+		t.Fatal("expected error for metacharacters")
+	}
+
+	tooMany := make([]string, MaxResolveCommandNames+1)
+	for index := range tooMany {
+		tooMany[index] = fmt.Sprintf("cmd%d", index)
+	}
+	if _, err := ValidateCommandNames(tooMany); err == nil {
+		t.Fatal("expected error for too many names")
+	}
+}
+
+func TestParseResolveCommandsOutput(t *testing.T) {
+	paths, missing := ParseResolveCommandsOutput(
+		[]string{"apt", "missing", "systemctl"},
+		"apt=/usr/bin/apt\nmissing=\nsystemctl=/usr/bin/systemctl\n",
+	)
+	if paths["apt"] != "/usr/bin/apt" || paths["systemctl"] != "/usr/bin/systemctl" {
+		t.Fatalf("paths = %#v", paths)
+	}
+	if len(missing) != 1 || missing[0] != "missing" {
+		t.Fatalf("missing = %#v", missing)
+	}
+}
+
+func TestBuildResolveCommandsRemote(t *testing.T) {
+	remote := BuildResolveCommandsRemote([]string{"apt"})
+	if !strings.Contains(remote, "command -v -- 'apt'") {
+		t.Fatalf("remote = %q", remote)
+	}
+	if !strings.Contains(remote, "printf '%s=%s\\n' 'apt'") {
+		t.Fatalf("remote missing printf = %q", remote)
+	}
+}