fix: unattended sudo via temporary NOPASSWD drop-in with triple cleanup

Piping a password into ssh -tt's pty raced and hung on the real run (worked in
a fast test, blocked for 14 min in practice). Replace with a temp
/etc/sudoers.d/mac-setup installed by _install_sudoers.sh (validated
before activation), removed on every exit path plus a 40-min on-Mac
self-destruct. setup.sh now fails fast if passwordless sudo is absent
instead of depending on a primed tty ticket.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/_install_sudoers.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Installs a TEMPORARY /etc/sudoers.d/mac-setup (NOPASSWD for seth) so an unattended setup run
+# has sudo for Homebrew's long, child-spawning install. Reads the sudo password from stdin.
+# Called by run.sh, which removes the drop-in afterward; a 40-min self-destruct is the backstop.
+set -euo pipefail
+read -r SUDO_PW
+tmp=$(mktemp)
+printf 'seth ALL=(ALL) NOPASSWD: ALL\n' > "$tmp"
+sudo -S -p '' -v <<<"$SUDO_PW"                          # prime once from the piped password
+sudo visudo -cf "$tmp"                                  # validate OFF to the side (bad sudoers breaks sudo)
+sudo install -m 440 -o root -g wheel "$tmp" /etc/sudoers.d/mac-setup
+rm -f "$tmp"
+nohup sudo bash -c 'sleep 2400; rm -f /etc/sudoers.d/mac-setup' >/dev/null 2>&1 &  # survives ssh drop
+echo "[set] temp NOPASSWD drop-in installed (+40m self-destruct)"