feat(sudo-io): stop recording bulk data (sudoers BULK_DATA !log_output fleet-wide), drop >64 MiB streams from archives, prune existing bulk recordings

playbooks/bootstrap-infra-ops-user.yaml

@@ -77,6 +77,11 @@ steps:
     shell: |
       f=/etc/sudoers.d/{{ ops_user }}
       printf 'Defaults:%s log_output\n%s ALL=(ALL) NOPASSWD:ALL\n' '{{ ops_user }}' '{{ ops_user }}' > "$f.tmp"
+      # Bulk data movers keep their audit line but their bytes are not recorded (Prime 2026-10-04; see
+      # playbooks/sudoers-infra-ops-bulk-no-log-output.yaml, which back-filled every existing host)
+      printf '%s\n' '# Bulk data movers: keep the audit line, do not record the bytes (eshpfi playbooks/sudoers-infra-ops-bulk-no-log-output.yaml)' \
+        'Cmnd_Alias BULK_DATA = /usr/bin/rsync, /usr/bin/tar, /usr/bin/cat, /usr/bin/dd, /usr/bin/zstd, /usr/bin/zcat, /usr/bin/gzip, /usr/bin/pv, /usr/bin/docker save *, /usr/bin/docker export *, /usr/bin/docker cp *' \
+        'Defaults!BULK_DATA !log_output' >> "$f.tmp"
       chmod 440 "$f.tmp"
       if visudo -cf "$f.tmp"; then mv "$f.tmp" "$f"; else rm -f "$f.tmp"; echo "VISUDO VALIDATION FAILED"; exit 1; fi