perf(swarm-test): take the sudo prompt off the lab administrator

Three runs of the transport benchmark, per module call:

              become off   become on
  docker          247ms       246ms
  ssh over mesh   215ms      1259ms

The connection is not the cost - ssh through the tunnel beats docker exec by
13% - and the tunnel is 4%. What the meshed arm pays is the sudo prompt: free
over the container connection, which runs as root, and 1046ms per escalated
call over ssh as the administrator. That is the 414ms per task the three-arm
comparison measured across a whole deploy.

A lab-only sudoers drop-in removes it. It is applied from the mesh prologue
while the inventory still reaches the nodes as root, so it is in place before
anything logs in as the administrator, and it touches no role: production
keeps 'administrator ALL=(ALL) ALL' and its password prompt.

The cost is that CI no longer exercises password sudo over the mesh. It never
exercised it on the direct arm either, which connects as root, and a wrong
password fails loudly rather than silently.

lab-sudo.yml

@@ -0,0 +1,14 @@
+---
+- name: "🔓 Let the lab's administrator escalate without a prompt"
+  hosts: all
+  become: true
+  gather_facts: false
+  tasks:
+    - name: "🔓 Drop the lab sudoers override"
+      ansible.builtin.copy:
+        content: "administrator ALL=(ALL) NOPASSWD: ALL\n"
+        dest: /etc/sudoers.d/zz-swarm-lab-administrator
+        owner: root
+        group: root
+        mode: "0440"
+        validate: "visudo -cf %s"

utils/tests/swarm/matrix.py

@@ -15,6 +15,7 @@ from utils.tests.swarm.extend_inventory import mesh_enabled
 from utils.tests.swarm.mesh import (
     bootstrap_mesh,
     converge_mesh,
+    lab_sudo_without_prompt,
     mesh_controller,
     switch_to_mesh_transport,
     transport_bench,
@@ -276,6 +277,8 @@ def _mesh_prologue(
         round_variants: the round's ``{app_id: variant_index}`` map.
     """
     rc = bootstrap_mesh(inv_dir=inv_dir)
+    if rc == 0:
+        rc = lab_sudo_without_prompt(inv_dir=inv_dir)
     if rc == 0:
         rc = _reset_credentials(
             app_id=app_id, inv_dir=inv_dir, round_variants=round_variants

utils/tests/swarm/mesh.py

@@ -14,6 +14,7 @@ _MESH_NAME = "swarm"
 _CONTROLLER = "localhost"
 _PLAYBOOK = "playbook-mesh.yml"
 _BENCH_PLAYBOOK = "transport-bench.yml"
+_SUDO_PLAYBOOK = "lab-sudo.yml"
 _SWARM_EXTRAS_VARS = "inventories/development/swarm.yml"
 _DEFAULT_ADMIN_KEY = "/tmp/swarm-nfs-admin.key"  # noqa: S108 - ephemeral swarm-test path, overridable via KEY_PATH
 
@@ -131,6 +132,37 @@ def mesh_controller(*, inv_dir: str) -> int:
     )
 
 
+def lab_sudo_without_prompt(*, inv_dir: str) -> int:
+    """Take the sudo prompt off the lab's administrator before the switch.
+
+    Measured over the mesh, an escalated module call costs 1046ms more than an
+    unescalated one, while over the container connection -- which runs as root
+    and so never prompts -- escalation is free. The prompt, not the transport,
+    is what the meshed arm was paying: SSH through the tunnel is itself faster
+    per call than docker exec.
+
+    Runs while the inventory still reaches the nodes as root, so it is in place
+    before anything logs in as the administrator.
+
+    Args:
+        inv_dir: inventory directory of the round.
+    """
+    if not mesh_enabled():
+        return 0
+    return run_step(
+        [
+            "ansible-playbook",
+            "-i",
+            f"{inv_dir}/devices.yml",
+            "--vault-password-file",
+            f"{inv_dir}/.password",
+            _SUDO_PLAYBOOK,
+        ],
+        env=os.environ.copy(),
+        label="take the sudo prompt off the lab administrator",
+    )
+
+
 def transport_bench(*, inv_dir: str, extras_path: str, label: str) -> int:
     """Time a fixed number of module calls over whatever transport is in force.