controllerswap: stdin tee write + narrow FELHOM_CONTROLLERSWAP grants (non-root, v0.45.0)

writeImage drops bash -c/printf for GuestExecStdin(img+\n -> tee /etc/felhom-controller-image);
new Runner.RunStdin/GuestExecStdin route stdin through the fenced sudo -n runner. 5 narrow,
auditable sudoers grants (no general pct exec, no bash -c) + capability manifest entries (Critical)
so the self-probe watches them and the build-test asserts coverage (companion red-proof). No
controller change; swap orchestration/rollback/state unchanged. Spike GO.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPZ4GJ8L5Jqf8UiPwbn1kt

internal/storage/hostops_disk_test.go

@@ -3,6 +3,7 @@ package storage
 import (
 	"context"
 	"errors"
+	"io"
 	"strings"
 	"testing"
 )
@@ -14,6 +15,10 @@ type scriptedRunner struct {
 	errs    map[string]error
 }
 
+func (r *scriptedRunner) RunStdin(ctx context.Context, _ io.Reader, name string, args ...string) ([]byte, []byte, error) {
+	return r.Run(ctx, name, args...)
+}
+
 func (r *scriptedRunner) Run(_ context.Context, name string, args ...string) ([]byte, []byte, error) {
 	r.calls = append(r.calls, append([]string{name}, args...))
 	base := name

internal/storage/hostops_test.go

@@ -2,6 +2,7 @@ package storage
 
 import (
 	"context"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -18,6 +19,10 @@ type scriptRunner struct {
 	err   error
 }
 
+func (s *scriptRunner) RunStdin(ctx context.Context, _ io.Reader, name string, args ...string) ([]byte, []byte, error) {
+	return s.Run(ctx, name, args...)
+}
+
 func (s *scriptRunner) Run(_ context.Context, name string, args ...string) ([]byte, []byte, error) {
 	s.calls = append(s.calls, append([]string{name}, args...))
 	return s.out[name], nil, s.err

internal/storage/role_test.go

@@ -38,10 +38,10 @@ func TestSystemDisks_FromBootMounts(t *testing.T) {
 func TestRoleForStorage_DemoMapping(t *testing.T) {
 	sys, ok := SystemDisks(demoHost())
 	cases := []struct {
-		name    string
-		typ     string
-		device  string
-		want    DeviceRole
+		name   string
+		typ    string
+		device string
+		want   DeviceRole
 	}{
 		{"builtin local (root fs)", hub.StorageTypeLocal, "", RoleSystem},
 		{"local-lvm (lvmthin)", hub.StorageTypeLVMThin, "", RoleSystem},

internal/storage/validate_test.go

@@ -2,6 +2,7 @@ package storage
 
 import (
 	"context"
+	"io"
 	"strings"
 	"testing"
 
@@ -16,6 +17,10 @@ type recordingRunner struct {
 	err   error
 }
 
+func (r *recordingRunner) RunStdin(ctx context.Context, _ io.Reader, name string, args ...string) ([]byte, []byte, error) {
+	return r.Run(ctx, name, args...)
+}
+
 func (r *recordingRunner) Run(_ context.Context, name string, args ...string) ([]byte, []byte, error) {
 	r.calls = append(r.calls, append([]string{name}, args...))
 	return nil, nil, r.err