Let the manager run the helper through sudo

ProtectKernelTunables, ProtectKernelModules and LockPersonality imply
NoNewPrivileges for a non-root unit, so sudo refused to start the helper
(hostname, reboot, network changes all failed). Guarded by a test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_units.py

@@ -0,0 +1,30 @@
+from pathlib import Path
+
+UNITS = Path(__file__).resolve().parent.parent / "systemd"
+
+# Settings that make systemd set no_new_privs for a unit that does not run as root
+# (systemd.exec(5)). sudo cannot gain root under that flag.
+IMPLY_NO_NEW_PRIVILEGES = (
+    "NoNewPrivileges", "SystemCallFilter", "SystemCallArchitectures", "RestrictAddressFamilies",
+    "RestrictNamespaces", "PrivateDevices", "ProtectKernelTunables", "ProtectKernelModules",
+    "ProtectKernelLogs", "ProtectClock", "MemoryDenyWriteExecute", "RestrictRealtime",
+    "RestrictSUIDSGID", "DynamicUser", "LockPersonality",
+)
+
+
+def settings(unit):
+    result = {}
+    for line in (UNITS / unit).read_text().splitlines():
+        key, sep, value = line.partition("=")
+        if sep and not line.startswith("#"):
+            result[key.strip()] = value.strip()
+    return result
+
+
+def test_manager_can_use_sudo_for_the_helper():
+    unit = settings("voxip-kiosk-manager.service")
+    assert unit["User"] == "voxip"
+    for key in IMPLY_NO_NEW_PRIVILEGES:
+        assert unit.get(key, "no") in ("no", "false", ""), key
+    for key in ("ProtectSystem", "ProtectHome", "PrivateTmp"):
+        assert key not in unit, key