#3716 @swamp/cve/dirtyfrag mitigate uses interactive sudo, so it can hang on a password prompt or fail mid-run

cve/dirtyfrag/extensions/models/dirtyfrag_detect.ts mitigate checks whoami and prefixes plain 'sudo ' (no -n) to sh -c wrapped commands. When sudo needs a password: over SSH there is no tty, so each command fails, the exit code is only logged, and mitigate still reports the host as mitigated if dryRun=false. On the local transport sudo opens /dev/tty directly, so the run can block on a prompt swamp never shows (from reading the code; not reproduced). The sh -c wrapper also defeats sudoers rules scoped to specific binaries. The @swamp/ssh sudo contract (sudo -n --, no sh -c for plain commands, ssh/README.md sudo section) is the better model; #3711 adopts it for the PHP extension. Expected: preflight sudo -n true, fail fast with a clear needs-privilege result, and never mark a host mitigated when a command failed.