sudoers: escape commas in lvs/lsblk -o arg lists (visudo -cf rejected the file)

Bare commas are command separators in sudoers; the lvs/lsblk -o option lists need
escaped commas. The file had never been visudo-validated live (the demo host ran the
agent root+direct). Surfaced by the BUNDLE host-install visudo -cf gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -33,6 +33,12 @@ tooling; the binary itself is a version-only rebuild (no behavioural change).
   to `/api/packages/admin/generic/felhom-golden/<golden-version>/golden.tar.zst` (`<golden-version>` =
   the baked controller version), printing `GOLDEN_VERSION` + `GOLDEN_SHA256`. Opt-in (only when the
   Gitea creds are set); the local-golden auto-discovery stays as a fallback.
+- **`configs/felhom-agent.sudoers` (latent bug fix):** escaped the commas in the `lvs -o
+  lv_name\,data_percent\,metadata_percent` and `lsblk -o NAME\,FSTYPE\,PTTYPE\,MOUNTPOINT` argument
+  lists. Sudoers treats a bare comma as a command separator, so `visudo -cf` REJECTED the file — it had
+  never been visudo-validated live because the demo host ran the agent as root+`direct` (sudoers
+  unused). The escaped commas still match the agent's real comma-bearing args. Surfaced by the BUNDLE
+  live install (the host-install script `visudo -cf`-validates before installing).
 - **`cmd/felhom-agent/main.go`:** `version` 0.42.0 → 0.43.0.
 - The operator records the printed agent + golden version+sha256 in the hub (Configs → "Day-0
   artifacts"); the host-bootstrap script verifies fetched artifacts against those before installing.

configs/felhom-agent.sudoers

@@ -24,7 +24,7 @@ Cmnd_Alias FELHOM_DISK = \
   /usr/sbin/smartctl -a -j /dev/nvme[0-9]*n[0-9]*, \
   /usr/sbin/smartctl -a -j /dev/vd[a-z]*, \
   /usr/sbin/smartctl -a -j /dev/hd[a-z]*, \
-  /usr/sbin/lvs --reportformat json --units b -o lv_name,data_percent,metadata_percent -- *
+  /usr/sbin/lvs --reportformat json --units b -o lv_name\,data_percent\,metadata_percent -- *
 
 # Provisioning back-half (slice 8A, doc 03 §6): populate a guest's bootstrap config mount
 # host-side (internal/provision). These are host-root ops the API token cannot do — a bind mount
@@ -43,7 +43,7 @@ Cmnd_Alias FELHOM_PROVISION = \
 # only) + fstype before any exec — the wildcard is the coarse allowlist, the agent is the fine gate.
 Cmnd_Alias FELHOM_FORMAT = \
   /usr/sbin/blkid -p -o export /dev/*, \
-  /usr/bin/lsblk -J -o NAME,FSTYPE,PTTYPE,MOUNTPOINT /dev/*, \
+  /usr/bin/lsblk -J -o NAME\,FSTYPE\,PTTYPE\,MOUNTPOINT /dev/*, \
   /usr/sbin/mkfs.ext4 -F /dev/*, \
   /usr/sbin/mkfs.xfs -f /dev/*