Remove stale passwordless sudo grants during boot and revoke a live grant immediately if its transient expiry timer cannot be created. Exercise both failure paths and the shipped tmpfiles rule against a disposable root.
Co-authored-by: Adolanium <94890352+Adolanium@users.noreply.github.com>