Wire action-group variables, sudo, and command path resolution through the API and UI.

Completes run-if/set_variable and requires_sudo editing, sudoers path resolve helpers, and execute permission checks so node action groups can gate upgrades and elevate safely.

service/internal/auth/ssh_run.go

@@ -32,11 +32,12 @@ func RunSSHShell(
 	if strings.TrimSpace(command) == "" {
 		return SSHRunResult{}, fmt.Errorf("command is required")
 	}
-	fullCommand := prependEnvExports(env, command)
+	fullCommand := PrependEnvExports(env, command)
 	return runSSHSession(hostIP, username, privateKeyPEM, passphrase, fullCommand, timeout)
 }
 
 // RunSSHScript uploads and runs a multi-line script via bash -s on the remote host.
+// When requiresSudo is true, the remote command is "sudo -n bash -s".
 func RunSSHScript(
 	hostIP string,
 	username string,
@@ -45,6 +46,7 @@ func RunSSHScript(
 	scriptBody string,
 	env map[string]string,
 	timeout time.Duration,
+	requiresSudo bool,
 ) (SSHRunResult, error) {
 	if strings.TrimSpace(scriptBody) == "" {
 		return SSHRunResult{}, fmt.Errorf("script body is required")
@@ -95,7 +97,11 @@ func RunSSHScript(
 	session.Stderr = &stderrBuf
 	session.Stdin = strings.NewReader(scriptBody)
 
-	remoteCommand := prependEnvExports(env, "bash -s")
+	bashCommand := "bash -s"
+	if requiresSudo {
+		bashCommand = "sudo -n bash -s"
+	}
+	remoteCommand := PrependEnvExports(env, bashCommand)
 	done := make(chan error, 1)
 	go func() {
 		done <- session.Run(remoteCommand)
@@ -207,7 +213,8 @@ func finishSSHResult(stdout string, stderr string, err error) (SSHRunResult, err
 	return result, err
 }
 
-func prependEnvExports(env map[string]string, command string) string {
+// PrependEnvExports builds the remote command string with optional export PREFIX; command.
+func PrependEnvExports(env map[string]string, command string) string {
 	if len(env) == 0 {
 		return command
 	}