Portable install: the binary installs itself; static builds on five architectures; root via sudo, doas or uid 0; every package manager; older systemd; no lsblk

- hamlab install / uninstall (internal/setup): systemd or OpenRC, elevates through
  sudo or doas, runs as the invoking user, sets or generates the password, names only
  journal groups that exist, waits for /healthz, reports an active firewalld/ufw.
  --purge and the data chown never touch a directory that isn't Ham Lab's alone.
- install.sh: curl-able bootstrap (arch detection, SHA256SUMS, offline beside the
  binaries, noexec /tmp fallback). make release builds dist/ for amd64, arm64, arm
  (ARMv6), 386, riscv64. Every build is CGO_ENABLED=0; the native one used to link glibc.
- internal/priv replaces every literal `sudo -n`: uid 0, sudo or doas.
- Updates acts on dnf, zypper, pacman and apk as well as apt; dnf shows installed versions.
- Services falls back to the plain systemctl table before systemd 246 and says so on
  hosts without systemd. Disks falls back to /sys/block without lsblk.
- Listener binds with IP_FREEBIND, so a LAN address that isn't up at boot is no failure.
- Self-update: the new build must pass `check` against the live config, is put in
  place by atomic rename, and the daemon re-execs itself (same under any supervisor).
- State and config writes are fsynced; a corrupt state.json is set aside, not fatal.
- Terminal shutdown no longer empties the saved list, so names come back after a
  restart by design rather than by winning a race.
- Config default is ~/.config/hamlab; an existing ~/apps/hamlab is still found.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/cron/cron.go

@@ -24,6 +24,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"hamlab/internal/priv"
 )
 
 type Job struct {
@@ -147,7 +149,7 @@ func runLines(ctx context.Context, fn func(line []byte), args ...string) error {
 
 func (m *Manager) sudoArgs(args ...string) []string {
 	if m.sudo {
-		return append([]string{"sudo", "-n"}, args...)
+		return priv.Wrap(args...)
 	}
 	return args
 }
@@ -326,7 +328,7 @@ func (m *Manager) readSource(ctx context.Context, s source) (string, error) {
 		if !m.sudo {
 			return "", errors.New("needs sudo")
 		}
-		out, err := run(ctx, "", "sudo", "-n", "crontab", "-u", u, "-l")
+		out, err := run(ctx, "", priv.Wrap("crontab", "-u", u, "-l")...)
 		if err != nil && strings.Contains(err.Error(), "no crontab") {
 			return "", nil
 		}
@@ -334,7 +336,7 @@ func (m *Manager) readSource(ctx context.Context, s source) (string, error) {
 	}
 	b, err := os.ReadFile(s.name)
 	if err != nil && m.sudo {
-		out, err2 := run(ctx, "", "sudo", "-n", "cat", s.name)
+		out, err2 := run(ctx, "", priv.Wrap("cat", s.name)...)
 		return out, err2
 	}
 	return string(b), err
@@ -356,7 +358,7 @@ func (m *Manager) sources(ctx context.Context) []source {
 	users := map[string]bool{}
 	if m.sudo {
 		for _, dir := range []string{"/var/spool/cron/crontabs", "/var/spool/cron"} {
-			if out, err := run(ctx, "", "sudo", "-n", "ls", "-1", dir); err == nil {
+			if out, err := run(ctx, "", priv.Wrap("ls", "-1", dir)...); err == nil {
 				for _, n := range strings.Split(out, "\n") {
 					if n = strings.TrimSpace(n); userRe.MatchString(n) {
 						users[n] = true
@@ -441,7 +443,7 @@ func (m *Manager) lastRunsFromJournal(ctx context.Context) map[string]int64 {
 		args = append(args, "--since", "-30d", "-n", "20000")
 	}
 	if m.journalSudo {
-		args = append([]string{"sudo", "-n"}, args...)
+		args = priv.Wrap(args...)
 	}
 	seen := m.logging
 	_ = runLines(ctx, func(line []byte) {
@@ -478,7 +480,7 @@ func (m *Manager) lastRunsFromJournal(ctx context.Context) map[string]int64 {
 func (m *Manager) JobLogs(ctx context.Context, j Job, n int) ([]map[string]any, error) {
 	args := []string{"journalctl", "-t", "CRON", "-t", "cron", "-t", "crond", "-o", "json", "--no-pager", "-q", "-n", "20000"}
 	if m.journalSudo {
-		args = append([]string{"sudo", "-n"}, args...)
+		args = priv.Wrap(args...)
 	}
 	var res []map[string]any
 	needle := "(" + j.User + ") CMD (" + j.Command + ")"
@@ -658,13 +660,13 @@ func (m *Manager) WriteSource(ctx context.Context, name, text string) error {
 			_, err := run(ctx, text, "crontab", "-")
 			return err
 		}
-		_, err := run(ctx, text, "sudo", "-n", "crontab", "-u", s.user, "-")
+		_, err := run(ctx, text, priv.Wrap("crontab", "-u", s.user, "-")...)
 		return err
 	}
 	if name != "/etc/crontab" && !strings.HasPrefix(name, "/etc/cron.d/") {
 		return errors.New("refusing to write outside /etc/crontab and /etc/cron.d")
 	}
-	_, err := run(ctx, text, "sudo", "-n", "tee", name)
+	_, err := run(ctx, text, priv.Wrap("tee", name)...)
 	m.mu.Lock()
 	m.lastAt = time.Time{}
 	m.mu.Unlock()
@@ -708,7 +710,7 @@ func (m *Manager) StartRun(ctx context.Context, j Job) (*Run, error) {
 	cmdline, stdin := cronPercent(j.Command)
 	args := []string{"sh", "-c", cmdline}
 	if j.User != m.self {
-		args = append([]string{"sudo", "-n", "-u", j.User, "-H"}, args...)
+		args = priv.AsUser(j.User, args...)
 	}
 	r := &Run{ID: jobID("run", strconv.FormatInt(time.Now().UnixNano(), 10)), JobID: j.ID, Command: j.Command, User: j.User, Started: time.Now(), Running: true}
 	runCtx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)