controllerswap: stdin tee write + narrow FELHOM_CONTROLLERSWAP grants (non-root, v0.45.0)

writeImage drops bash -c/printf for GuestExecStdin(img+\n -> tee /etc/felhom-controller-image);
new Runner.RunStdin/GuestExecStdin route stdin through the fenced sudo -n runner. 5 narrow,
auditable sudoers grants (no general pct exec, no bash -c) + capability manifest entries (Critical)
so the self-probe watches them and the build-test asserts coverage (companion red-proof). No
controller change; swap orchestration/rollback/state unchanged. Spike GO.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

internal/provision/backhalf_test.go

@@ -20,6 +20,10 @@ type recRunner struct {
 	fail string // if a command's name == fail, return an error
 }
 
+func (r *recRunner) RunStdin(ctx context.Context, _ io.Reader, name string, args ...string) ([]byte, []byte, error) {
+	return r.Run(ctx, name, args...)
+}
+
 func (r *recRunner) Run(_ context.Context, name string, args ...string) ([]byte, []byte, error) {
 	r.mu.Lock()
 	r.cmds = append(r.cmds, append([]string{name}, args...))
@@ -70,7 +74,10 @@ type mintMinter struct {
 	vmids []int
 }
 
-func (m *mintMinter) Mint(vmid int) (string, error) { m.vmids = append(m.vmids, vmid); return m.token, nil }
+func (m *mintMinter) Mint(vmid int) (string, error) {
+	m.vmids = append(m.vmids, vmid)
+	return m.token, nil
+}
 
 func testLogger() *slog.Logger { return slog.New(slog.NewTextHandler(io.Discard, nil)) }