sudo: give every command run through sudo a terminal of its own

An agent the operator starts as the agent account through sudo (hq ADR 0266)
would otherwise share the operator's terminal and could push keystrokes into
their shell after it ends. sudo still runs without a terminal for the mesh's
own tools, so nothing they do changes.

modules/sudo/cmd/sudo-tools/manifest_test.go

@@ -41,7 +41,7 @@ func TestTheDropInGrantsExactlyTheOperatorAccountAndParses(t *testing.T) {
 			rules = append(rules, l)
 		}
 	}
-	if len(rules) != 1 || rules[0] != "${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL" {
+	if len(rules) != 2 || rules[0] != "Defaults use_pty" || rules[1] != "${machine:account} ALL=(ALL:ALL) NOPASSWD: ALL" {
 		t.Fatalf("rules: %q", rules)
 	}
 	if !strings.HasSuffix(content, "\n") {