fix: preflight the sudoers grants by destination, not by command path

oolon is a shared edge proxy. blackbeard.observer and others already grant
gitea_ci `/usr/bin/rsync` into their own webroots, so checking for the bare
command path passed on somebody else's grant — and the deploy would then fail at
the rsync, halfway, having already been told everything was fine.

The grants are destination-qualified in script/infra-setup.sh for exactly this
reason; the check now matches them.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f

.gitea/workflows/deploy.yaml

@@ -114,10 +114,14 @@ jobs:
           set -euo pipefail
           allowed=$(ssh "$EDGE_HOST" sudo -n -l 2>/dev/null || true)
           missing=0
+          # Destination-qualified, not just the command path. oolon is a SHARED
+          # proxy: blackbeard.observer and others already grant gitea_ci
+          # /usr/bin/rsync into *their* webroots, so a bare command check passes
+          # on somebody else's grant and the deploy then fails at the rsync.
           for cmd in \
-            "/usr/bin/rsync" \
-            "/usr/sbin/restorecon" \
-            "/usr/sbin/nginx" \
+            "/usr/bin/rsync * $WEBROOT/" \
+            "/usr/sbin/restorecon -R $WEBROOT" \
+            "/usr/sbin/nginx -t" \
             "/usr/bin/systemctl reload nginx"
           do
             if ! grep -qF -- "$cmd" <<<"$allowed"; then