fix(v0.92.0): the guestnet probes need their own sudoers grant (found live)

The first sweep on felhom-pve logged 'dhclient liveness probe failed: sudo: a password is
required' and reported state=unknown — the watchdog fail-safed correctly, but it was blind.
TASK-D assumed no sudoers change; the existing grant only covered lanresolver's address read.

FELHOM_GUESTNET adds four FIXED vectors (route, interfaces, pgrep, and the incident's heal
invocation). Every argument after the numeric vmid is a literal, so nothing the guest or the
hub says can widen the grant. Plus four guestnet-* capability rows, non-critical, so a host
that has not taken the new sudoers is visibly degraded without paging an operator per box.

CHANGELOG.md

@@ -58,6 +58,16 @@ block named against the convention.
   every unit test green. Red-proof: un-wiring both lines fails the test with both reasons named.
 - Red-proof for the detection itself: reverting `classify` to IP-presence-only makes the July-20
   fixture report **"healthy"** and records **zero** heals — the 80-minute silent window, reproduced.
+- **Ships a sudoers change** (`configs/felhom-agent.sudoers` MUST be deployed with the binary).
+  TASK-D assumed none was needed; live verification on felhom-pve proved otherwise — the first sweep
+  logged `dhclient liveness probe failed: sudo: a password is required` and correctly reported
+  `state=unknown` rather than acting blind. The existing grant covered only lanresolver's address
+  read. `FELHOM_GUESTNET` adds four fixed vectors (route, interfaces, pgrep, and the heal), every
+  argument after the numeric vmid a literal, so no hub or guest input can widen it. The address read
+  is not duplicated — it stays FELHOM_DNSMASQ's.
+- Four `guestnet-*` capability rows so a host missing that sudoers file is VISIBLE as degraded
+  rather than silently watchdog-less. Non-critical on purpose: a missing grant must not page an
+  operator for every box on rollout day (the R-50b amber-fleet lesson).
 - `var version` in main.go was stale at `0.89.0` (three releases behind); builds set it via ldflags,
   but `go run` and any forgotten `-X` reported a version that had not existed for days.