/etc/sudoers.d/ops-agent grants NOPASSWD to ops-agent for the exact systemctl restart invocations whitelisted in commands.yml. setup.sh installs and validates it via visudo -c. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>