port the user account section, and stop clobbering files in the home

Two real defects fixed on the way across.

The sudoers write was in the wrong order. The original echoed the rule straight
into /etc/sudoers.d, validated it afterwards, and chmod'd it later still. A
malformed file there breaks sudo COMPLETELY — and you cannot sudo to repair it,
so on a remote machine that is a rescue console — and so does one with loose
permissions, because sudo refuses to read its own configuration. Both of those
windows were live in the original ordering. grant_passwordless_sudo now writes a
temp file, runs visudo -c against it, and only then places it with install(1),
which applies the content and the 0440 mode in one step. Nothing reaches
/etc/sudoers.d that has not already been validated.

The .tmux.conf copy overwrote whatever was in the home on every run. lib/files.sh
adds the two shapes that stop this whole class of thing:

  install_config  installs when absent, does nothing when identical, and keeps
                  what the user wrote when it differs — printing the cp to take
                  ours, so the choice stays theirs
  append_once     wraps a block in named markers so a second run recognises its
                  own work; also lets a human see which lines came from this
                  script and remove them as a unit

append_once is what the five unguarded `cat >>` into .zshrc need when those
sections are ported — a second pass currently duplicates the starship init, the
nvim PATH, bun, deno and the aliases.

Passwordless sudo is asked separately from creating the account, because it is a
security posture rather than part of making a user, and the cost is stated: a key
that can log into this account is root without a further step. Officer's actual
requirement is stated too — os-user-shell.ts runs `sudo -n`, and a prompt it
cannot answer surfaces as a permissions error rather than a question — and
refusing records that consequence in the summary instead of a bare "skipped".

Verified: all three install_config outcomes, append_once writing exactly once
across two runs, visudo rejecting junk before anything is installed, and the
section reporting correctly against this host's existing account.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/base.sh

@@ -212,6 +212,43 @@ as_user() {
   sudo -u "$USERNAME" -i bash -c "$1"
 }
 
+# -----------------------------------------------------------------------------
+# sudoers
+# -----------------------------------------------------------------------------
+
+# Grant an account passwordless sudo, safely.
+#
+# A malformed file in /etc/sudoers.d breaks sudo COMPLETELY — and you cannot sudo
+# to repair it, so on a remote machine that is unrecoverable short of a rescue
+# console. The same is true of one with loose permissions: sudo refuses to read
+# its own configuration and every sudo on the box fails.
+#
+# The original wrote the file into /etc/sudoers.d first and validated it after,
+# with a chmod later still. Both of those leave a window where a broken or
+# world-readable sudoers file is live. This validates a temp file first and then
+# places it with its mode in a single install(1) — so what lands in /etc is
+# already known good and already 0440.
+grant_passwordless_sudo() {
+  local user="$1" dest="/etc/sudoers.d/99-${user}-nopasswd" tmp
+  tmp="$(mktemp)"
+
+  echo "${user} ALL=(ALL) NOPASSWD: ALL" >"$tmp"
+
+  if ! visudo -c -f "$tmp" >/dev/null 2>&1; then
+    rm -f "$tmp"
+    fail "visudo rejected the sudoers entry for '${user}' — not installing it"
+  fi
+
+  install -m 0440 -o root -g root "$tmp" "$dest"
+  rm -f "$tmp"
+}
+
+has_passwordless_sudo() {
+  local user="$1"
+  [[ -f "/etc/sudoers.d/99-${user}-nopasswd" ]] ||
+    grep -rqsE "^${user}[[:space:]]+ALL=\(ALL\)[[:space:]]+NOPASSWD" /etc/sudoers /etc/sudoers.d 2>/dev/null
+}
+
 # -----------------------------------------------------------------------------
 # Operating system detection
 # -----------------------------------------------------------------------------