feat(security): swap sudo for the memory-safe sudo-rs

security.sudo-rs.enable sets security.sudo.enable = false via mkDefault, so
this is a straight swap; the two modules assert against being on together.

The fleet only uses the stock policy -- wheel may run anything, with a password
-- which sudo-rs implements fully. It does not cover host aliases, LDAP/SSSD
sudoers, sudoreplay or most Defaults settings; needing any of those means
reverting to security.sudo. The macOS host is unaffected and keeps Apple's sudo
with Touch ID.

Recovery from a host that will not escalate is documented in the module and in
home/README.md: get a root shell that does not go through sudo, then roll back
the generation.

modules/common-nixos.nix

@@ -25,6 +25,22 @@
   # toolchains, language-server downloads) on every NixOS host, not just WSL.
   programs.nix-ld.enable = true;
 
+  # Memory-safe sudo. The two modules assert against being enabled together;
+  # this one sets `security.sudo.enable = false` via mkDefault, so it is a
+  # straight swap and not an addition.
+  #
+  # Safe here because this fleet only ever uses the stock policy -- wheel may
+  # run anything, with a password -- which sudo-rs implements completely. It
+  # does not cover the more exotic sudoers surface (host aliases, LDAP/SSSD
+  # sudoers, most `Defaults` settings, `sudoreplay`); adding any of those means
+  # going back to `security.sudo`.
+  #
+  # Recovery if a host ever refuses to escalate: get a root shell without sudo
+  # (`wsl -u root -d NixOS` on the WSL box, the console or a serial/HDMI login
+  # elsewhere) and roll back -- `nixos-rebuild switch --rollback`, or pick the
+  # previous generation from the boot menu.
+  security.sudo-rs.enable = true;
+
   # Minimal system-level CLI available before the home-manager profile loads
   # (e.g. early boot / rescue). User-level tooling lives in home-manager.
   environment.systemPackages = with pkgs; [