R-861: narrow the agent's root grants — exact sudo patterns, felhom-priv-apply content checker, fixed hook/parent files in the bundle, signed self-update verified as root, escrow root reads pinned

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

internal/storage/hostops_test.go

@@ -55,8 +55,9 @@ func TestHostOps_MountLifecycle(t *testing.T) {
 	if len(rr.calls) != 3 {
 		t.Fatalf("expected 3 commands, got %d: %v", len(rr.calls), rr.calls)
 	}
-	if rr.calls[0][0] != "/usr/bin/install" || !contains(rr.calls[0], "0644") {
-		t.Errorf("call[0] not the install: %v", rr.calls[0])
+	// R-861: the unit is installed by the root content checker, named — never a plain `install` of a staged path.
+	if rr.calls[0][0] != "/usr/local/sbin/felhom-priv-apply" || len(rr.calls[0]) != 3 || rr.calls[0][1] != "unit" {
+		t.Errorf("call[0] not the checker's unit install: %v", rr.calls[0])
 	}
 	if !contains(rr.calls[1], "daemon-reload") {
 		t.Errorf("call[1] not daemon-reload: %v", rr.calls[1])