sudoers: escape commas in lvs/lsblk -o arg lists (visudo -cf rejected the file)

Bare commas are command separators in sudoers; the lvs/lsblk -o option lists need
escaped commas. The file had never been visudo-validated live (the demo host ran the
agent root+direct). Surfaced by the BUNDLE host-install visudo -cf gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -33,6 +33,12 @@ tooling; the binary itself is a version-only rebuild (no behavioural change).
   to `/api/packages/admin/generic/felhom-golden/<golden-version>/golden.tar.zst` (`<golden-version>` =
   the baked controller version), printing `GOLDEN_VERSION` + `GOLDEN_SHA256`. Opt-in (only when the
   Gitea creds are set); the local-golden auto-discovery stays as a fallback.
+- **`configs/felhom-agent.sudoers` (latent bug fix):** escaped the commas in the `lvs -o
+  lv_name\,data_percent\,metadata_percent` and `lsblk -o NAME\,FSTYPE\,PTTYPE\,MOUNTPOINT` argument
+  lists. Sudoers treats a bare comma as a command separator, so `visudo -cf` REJECTED the file — it had
+  never been visudo-validated live because the demo host ran the agent as root+`direct` (sudoers
+  unused). The escaped commas still match the agent's real comma-bearing args. Surfaced by the BUNDLE
+  live install (the host-install script `visudo -cf`-validates before installing).
 - **`cmd/felhom-agent/main.go`:** `version` 0.42.0 → 0.43.0.
 - The operator records the printed agent + golden version+sha256 in the hub (Configs → "Day-0
   artifacts"); the host-bootstrap script verifies fetched artifacts against those before installing.