## RED (before the fix): python3 configs/test_felhom_priv_apply.py ControllerImage
    self.assertIn("controller-image", buf.getvalue())
    ~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AssertionError: 'controller-image' not found in 'felhom-priv-apply ok verbs=unit,dnsmasq,wg,sshd-config,sshd-key\n'

----------------------------------------------------------------------
Ran 5 tests in 0.002s

FAILED (failures=4)
## RED: go test ./internal/capability -run 'R861|ControllerImageVerb|FelhomOp'
=== RUN   TestSudoersRefusesTheR861Injections
    r861_injection_test.go:66: the sudoers still allows: /usr/sbin/pct exec 9201 -- tee /etc/felhom-controller-image
--- FAIL: TestSudoersRefusesTheR861Injections (0.09s)
=== RUN   TestSudoersAllowsTheControllerImageVerb
    r861_injection_test.go:108: the sudoers does not allow `felhom-priv-apply controller-image 9201` — a managed controller update cannot write its image
--- FAIL: TestSudoersAllowsTheControllerImageVerb (0.00s)
=== RUN   TestFelhomOpSudoersPctIsExact
    r861_injection_test.go:135: felhom-op's sudoers allows "/usr/sbin/pct stop 9201 --skiplock 1"
    r861_injection_test.go:135: felhom-op's sudoers allows "/usr/sbin/pct start 9201 9202"
    r861_injection_test.go:135: felhom-op's sudoers allows "/usr/sbin/pct unlock 9201 --whatever"
    r861_injection_test.go:135: felhom-op's sudoers allows "/usr/sbin/pct start 92a1"
--- FAIL: TestFelhomOpSudoersPctIsExact (0.00s)
FAIL
FAIL	gitea.dooplex.hu/admin/felhom-agent/internal/capability	0.099s
FAIL
