Let the manager run the helper through sudo

ProtectKernelTunables, ProtectKernelModules and LockPersonality imply
NoNewPrivileges for a non-root unit, so sudo refused to start the helper
(hostname, reboot, network changes all failed). Guarded by a test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

systemd/voxip-kiosk-manager.service

@@ -22,10 +22,10 @@ SyslogIdentifier=voxip-kiosk-manager
 # "sudo -n voxip-kiosk-helper" inherits this unit's mount namespace and must
 # be able to write /etc (hostname, NetworkManager profiles). The web process
 # itself runs unprivileged as user voxip and can only write its own dirs.
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
+# Also no ProtectKernelTunables/ProtectKernelModules/LockPersonality,
+# RestrictSUIDSGID, SystemCall*, ...: for a non-root unit those imply
+# NoNewPrivileges, and sudo then refuses to run (tests/test_units.py).
 ProtectControlGroups=yes
-LockPersonality=yes
 
 [Install]
 WantedBy=multi-user.target