test(stories): cover the scoped sudoers.d cluster (151-153)

[bferanmi806-sketch]

Summary

Adds three Ubuntu E2E stories covering the scoped sudoers.d cluster from the
#233 coverage map, one story per action:

Story	Action	Risk	Near miss
151	GetSudoGrants	Low (read-only)	GrantSudoAccess
152	GrantSudoAccess	High	RevokeSudoAccess
153	RevokeSudoAccess	High	GrantSudoAccess

Each story asserts a single step, the expected action and risk, the key params
(name / user / commands), and that the reciprocal near-miss action is
absent — so 151 (list) cannot plan a grant, 152 cannot plan a revoke, and 153
cannot plan a grant. The grant intent stays password-protected; nopasswd is
deliberately not requested because the daemon refuses a passwordless grant for a
command that can spawn other programs.

Because the story-coverage guard derives its figures from the tree, the coupled
counts are updated in the same commit: the suite is now 153 stories
(54 atomic + 99 Ubuntu), and the "action names still untouched by any story"
count drops 49 → 46 (the three actions above are cross-family). Updated in
CONTRIBUTING.md, docs/introduction.md, docs/testing/user-stories.md and
HACKING.md.

Related Issue

Part of #233 (the clustered story-coverage map). This does not close #233 —
it covers only the scoped sudoers.d cluster.

Validation

• Tests added or updated
• Documentation updated if behavior changed
• Security impact considered
• Trust boundary preserved (daemon remains the only privileged executor)
• CI passes

Host-side checks run locally:

• shellcheck tests/e2e/stories/story-151.sh story-152.sh story-153.sh — clean
• bash -n on all three stories — clean
• tests/e2e/story-metadata.test.sh — Story metadata derived cleanly: 153 stories (99 ubuntu, 54 atomic).
• scripts/check_evidence_claims.py . — Published figures match the evidence artifacts.

The stories themselves require a live VM + LLM (they call
sysknife --dry-run --json), so they are not executed here.

Notes for Reviewers

• No cassettes are recorded, matching the previous cluster PRs (test(e2e): add Groups stories 149-150 for CreateGroup/DeleteGroup #593): landing
  the stories first, with live recording done by a maintainer, keeps the PR small
  and reviewable.
• The doc-count edits are not cosmetic — scripts/check_evidence_claims.py
  refuses the PR if the derived family sizes and uncovered-action counts are not
  updated to match the new stories.
• Two further stale Ubuntu-family sizes (docs/testing/user-stories.md,
  HACKING.md) were corrected to 99 alongside the guard-mandated edits, since
  they describe the same family this PR extends.

[vladimirrott]

Thanks, @bferanmi806-sketch. Three more from the #233 map, in the house style of your #516 and #574, and the numbers in all four docs check out.

Reviewed at 75297f5. What I checked:

• All three actions are in KNOWN_ACTION_NAMES, and the asserted risks match the specs: GetSudoGrants low (sudoers.rs:46), GrantSudoAccess and RevokeSudoAccess high (sudoers.rs:84, :95). The .risk in --json comes from the catalogue, so those assertions are deterministic once the action is right.
• commands is a string in the executor (require_str, executor.rs:1313), so comparing .params.commands to /usr/bin/systemctl is the right shape.
• Recount on the merged tree: 153 stories = 54 atomic + 99 ubuntu, 49 → 46 untouched cross-family actions. The public-claims gate goes red when a story header flips family, which is the merge receipt.
• bash -n and shellcheck are clean. The stories use --dry-run, so no sudoers drop-in is ever written on the VM.

One nit, optional: story-152.sh assigns USER=..., which shadows the exported $USER. It's harmless here; GRANT_USER would read cleaner.

I'll merge once the board is green, then put a recount banner on #233 (sudoers cluster done, next free id 154). #219 and #482 are still yours. If either has stalled, tell me and I'll free it with no hard feelings.

[vladimirrott]

Main moved under this after #609 landed, and both PRs edited the same sentence in docs/testing/user-stories.md. I pushed a merge commit (bc292b5) that keeps your 99 and #609's "79 of them in the recorded live-VM runs". No other change. The claim gates pass on the merged tree (153 stories: 99 ubuntu, 54 atomic), so it lands as soon as CI is green.

[vladimirrott]

Re-approving at bc292b5 after the merge from main. The three stories are unchanged from the head I reviewed, and the only conflict edit is the one sentence described above.