sudo: count any sudo rule as root, fail on what cannot be judged, and commit no binary

The review of 2026-10-09: an unknown account and sudo that could not be asked were answered not root, and
only NOPASSWD on ALL counted, though NOPASSWD on systemctl, tee, bash or pacman reaches root as surely,
and a password the person typed is kept by sudo for minutes. Any rule now counts, as the node-engine's
own judge of an agent account does (ADR 0266); what cannot be judged fails the answer. The bundle built
in the module's directory is removed and ignored.

modules/sudo/cmd/sudo-tools/main.go

@@ -46,10 +46,11 @@ func tools(m *Machine) []stdio.Tool {
 		},
 		{
 			Name: "sudo_escalation",
-			Description: "Can these accounts become root on this machine without a person: a sudo rule running every " +
-				"command as root with no password, or a group that is root by another name (docker, disk). Each " +
-				"account with yes or no and why. Asked by the self-check where the router or a channel proving its " +
-				"sender runs (novox/hq ADR 0259).",
+			Description: "Can these accounts become root on this machine without a person: any sudo rule for it " +
+				"(with or without a password, for any command), or a group that is root by another name (docker, disk, " +
+				"root, lxd, incus-admin, libvirt). Each account with yes or no and why; an account that cannot be " +
+				"judged fails the answer, never a no. Read as the runtime's account: a reading for a person — the " +
+				"agent account's verdict is the node-engine's (novox/hq ADR 0259 §8, ADR 0266).",
 			Input: schema(map[string]any{"accounts": map[string]any{"type": "array", "items": map[string]any{"type": "string"},
 				"description": "the accounts to judge"}}),
 			Run: func(a map[string]any) (any, error) {