fix(elway): sudo uploads land root:root, validated and staged; add fleet ownership audit

elway's sudo upload did scp-as-user then `sudo mv`, and mv keeps the owner,
so every file it installed "as root" (systemd units, /etc configs, root-run
scripts) ended up owned by the SSH user. A sudoers drop-in installed that
way would be rejected by sudo outright.

elway:
- Sudo uploads now chown to root:root by default. Playbooks can override
  with `upload.owner:` and ad-hoc runs with `--owner`. An owner is refused
  on a non-sudo upload, and `--owner` outside an ad-hoc `--upload` is an
  error rather than silently ignored.
- Ownership and mode are applied to the STAGED file, then a single mv
  publishes it, so a failed chown can no longer leave the live path owned
  by the SSH user. chown runs before chmod so setuid bits survive. A trap
  removes the staged file on every exit path.
- A directory dest is refused before anything moves. mv would otherwise
  drop the file inside the directory under a staging name.
- `mode` was spliced unquoted into the remote root shell line. It is now
  validated as octal (^[0-7]{3,4}$) and shell-quoted, on both the sudo
  and non-sudo paths.
- `mode` and `owner` must be quoted YAML strings. YAML 1.1 turns a bare
  0644 into 420, a bare 1000:0 into 60000 and a bare yes into True, and
  str() of each is a different value that looks valid. All 85 playbooks
  already quote them.
- New preflight(): every step is resolved before any remote action. An
  undefined var or a templated owner that resolves badly is now refused
  up front, not after earlier steps have already changed the host.

scripts/fleet-ownership-audit.sh (new, read-only) finds files in root's
territory owned by a normal user. Tier A lists /etc, /usr/local, /root and
cron, judging symlinks by their target. Tier X covers files that root-run
units exec from /opt, /srv, /home or /volume1, reading drop-ins and quoted
paths. Tier B only summarises /opt app trees. A host that is unprivileged,
whose find fails, or whose run dies is reported INCOMPLETE (exit 5), never
clean. Completion is marked with a per-run nonce.

Verification: 24 unit tests in scripts/test_elway.py. Live checks on
esh-docker-vm: default lands root:root; the override lands infra-ops:adm at
4755 with setuid intact; a bad group fails with dest untouched and no
staging left; a directory dest is refused; a bad mode is refused before
any copy. Audit positive controls on nh3-dev (a drop-in-only root Exec, a
quoted path containing a space, a symlink to a user-owned target) were all
flagged; esh-docker-vm negative control was 0. Probes removed. Cross-model
bug-hunt (heid, Gróa arm + seat) findings folded.

playbooks/esh-docker-vm-restic-drop-kuma-block.yaml

@@ -24,8 +24,9 @@ steps:
       dest: /etc/restic/pre-backup.sh
       mode: '0700'
 
-  # elway's sudo upload is scp-as-user then `sudo mv`, so the file lands owned
-  # by the SSH user. This hook is executed by root: it must be root-owned.
+  # Belt and braces: elway's sudo upload defaults to root:root since
+  # 2026-09-23 (before that it kept the SSH user's ownership). This hook is
+  # executed by root, so the verify below checks it either way.
   - name: Make the hook root-owned
     sudo: true
     shell: chown root:root /etc/restic/pre-backup.sh

playbooks/esh-docker-vm-restic-drop-paperless-block.yaml

@@ -31,8 +31,9 @@ steps:
       dest: /etc/restic/pre-backup.sh
       mode: '0700'
 
-  # elway's sudo upload is scp-as-user then `sudo mv`, so the file lands owned
-  # by the SSH user. This hook is executed by root: it must be root-owned.
+  # Belt and braces: elway's sudo upload defaults to root:root since
+  # 2026-09-23 (before that it kept the SSH user's ownership). This hook is
+  # executed by root, so the verify below checks it either way.
   - name: Make the hook root-owned
     sudo: true
     shell: chown root:root /etc/restic/pre-backup.sh /var/lib/restic/repair-20260923/pre-backup.sh.pre-paperless