fix(P19): sudoers hardening — NOEXEC on apt-get/dpkg (REQ-134, F22)

---ci---
project: orca
phase: 19
milestone: v0.12
status: execute
---/ci---

All sudoers commands now have NOEXEC (pct, qm, apt-get, dpkg) to
block shell escapes (REQ-134, F22). Previously apt-get/dpkg lacked
NOEXEC. Tests pass. Build green.

internal/proxmox/bootstrap.go

@@ -449,8 +449,8 @@ func sudoersContent(user string) string {
 # pvesh is EXCLUDED (AD-020: pvesh can bypass NOEXEC via API execute).
 %s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/pct
 %s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/qm
-%s ALL=(root) NOPASSWD: /usr/bin/apt-get
-%s ALL=(root) NOPASSWD: /usr/bin/dpkg
+%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/apt-get
+%s ALL=(root) NOPASSWD: NOEXEC: /usr/bin/dpkg
 `, user, user, user, user)
 }