controllerswap: stdin tee write + narrow FELHOM_CONTROLLERSWAP grants (non-root, v0.45.0)

writeImage drops bash -c/printf for GuestExecStdin(img+\n -> tee /etc/felhom-controller-image);
new Runner.RunStdin/GuestExecStdin route stdin through the fenced sudo -n runner. 5 narrow,
auditable sudoers grants (no general pct exec, no bash -c) + capability manifest entries (Critical)
so the self-probe watches them and the build-test asserts coverage (companion red-proof). No
controller change; swap orchestration/rollback/state unchanged. Spike GO.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

internal/localapi/guestbind.go

@@ -3,6 +3,7 @@ package localapi
 import (
 	"context"
 	"fmt"
+	"io"
 	"log/slog"
 	"strconv"
 	"strings"
@@ -124,3 +125,15 @@ func (b *GuestBinder) GuestExec(ctx context.Context, vmid int, args ...string) (
 	}
 	return string(out), nil
 }
+
+// GuestExecStdin is GuestExec with the in-guest command's stdin fed from stdin. The controller-swap
+// write uses it to pipe the image ref into an in-guest `tee` (no shell vector, no interpolation),
+// through the same fenced runner so the `sudo -n` prefix stays in one place.
+func (b *GuestBinder) GuestExecStdin(ctx context.Context, vmid int, stdin io.Reader, args ...string) (string, error) {
+	pctArgs := append([]string{"exec", strconv.Itoa(vmid), "--"}, args...)
+	out, stderr, err := b.runner.RunStdin(ctx, stdin, "pct", pctArgs...)
+	if err != nil {
+		return string(out), fmt.Errorf("pct exec %d %v: %w: %s", vmid, args, err, strings.TrimSpace(string(stderr)))
+	}
+	return string(out), nil
+}