fix(setup): grant NOPASSWD sudo to the bootstrapped deploy user

shipnode's non-interactive setup/harden/deploy all assume sudo doesn't
prompt (the $SUDO pattern shells out and never handles a password).
syncUsers puts the user in the sudo group but that still requires a
password, so subsequent shipnode harden / shipnode deploy runs as
deploy would hang or fail. Drop a NOPASSWD:ALL sudoers.d file right
after user creation. Industry standard for CI/deploy accounts.

Author: devalade

src/cli/commands/setup.ts

@@ -68,6 +68,14 @@ async function bootstrapDeployUser(
   }
   ui.info(`Creating '${DEPLOY_USER}' on ${config.ssh.host}...`);
   await syncUsers(executor, [entry]);
+  // Grant NOPASSWD sudo — shipnode's non-interactive setup/harden/deploy all
+  // assume sudo doesn't prompt. Industry-standard for CI/deploy accounts; the
+  // tradeoff is that a compromise of the deploy user's SSH key gets root.
+  await executor.execOrThrow(
+    `SUDO=""; [ "$EUID" -ne 0 ] && SUDO="sudo"; ` +
+    `echo "${DEPLOY_USER} ALL=(ALL) NOPASSWD:ALL" | $SUDO tee "/etc/sudoers.d/shipnode-${DEPLOY_USER}" > /dev/null && ` +
+    `$SUDO chmod 440 "/etc/sudoers.d/shipnode-${DEPLOY_USER}"`,
+  );
   return true;
 }