fix(t4): docker_socket_reachable + pid_host_visible probes — drop unnecessary sudo / suppress / wrong perms (RCA from ad71d1f, unblocks template-cc PR#39 migration pilot)

Two gate-side probe bugs identified by RCA ad71d1f. template-cc PR#39
(uniform-contract migration pilot) surfaced both — fixes are gate-side,
not template-cc-side.

1. docker_socket_reachable
   Before: sudo -n docker version --format '{{.Server.Version}}' >/dev/null 2>&1
   After:  docker -H unix:///var/run/docker.sock version --format '{{.Server.Version}}'
   - agent user is in the `docker` group, so sudo is unnecessary and
     introduces a PATH/env mismatch under `sudo -n` (docker CLI not-found).
   - explicit -H unix:///var/run/docker.sock pins the transport
     deterministically.
   - dropping `>/dev/null 2>&1` lets daemon errors surface for diagnosis;
     non-zero exit still trips the probe, but the failure mode is now
     visible in CI/probe output instead of being silently swallowed.

2. pid_host_visible
   Before: [ -d /proc/1/root ] && [ "$(sudo -n readlink /proc/1/ns/pid)" = "$(sudo -n readlink /proc/self/ns/pid)" ]
   After:  sudo -n test -d /proc/1/root && [ "$(sudo -n readlink /proc/1/ns/pid)" = "$(sudo -n readlink /proc/self/ns/pid)" ]
   - /proc/1/root is a root-owned symlink; `[ -d ... ]` evaluated as
     uid-1000 (agent user) returns false (EACCES) even when host PID ns
     IS reachable — false negative.
   - sibling-pattern with the host-reach probes that PASS:
       host_root_reach_via_nsenter: `sudo -n nsenter ...`
       host_fs_write_readback:      `sudo -n sh -c "..."`
     Consistent `sudo -n` usage for host-namespace inspection.
   - readlink half already uses sudo -n; this fix makes the directory
     check consistent with it.

Probes remain executable from inside the workspace container as the
`agent` user. No semantics changed elsewhere (advisory/hard
classification preserved, no probe added/removed). Total diff: 2 lines.

/sop-ack root-cause-and-no-backwards-compat

workspace-server/internal/provisioner/t4_privilege_contract.go

@@ -121,7 +121,7 @@ func T4PrivilegeContract() []T4Capability {
 		{
 			Name:        "docker_socket_reachable",
 			Description: "/var/run/docker.sock is bind-mounted into the container so the agent can manage other containers (T4 use case: agent-as-orchestrator). Proven by 'docker version' returning a server section, which requires the daemon to answer over the socket.",
-			Probe:       `sudo -n docker version --format '{{.Server.Version}}' >/dev/null 2>&1`,
+			Probe:       `docker -H unix:///var/run/docker.sock version --format '{{.Server.Version}}'`,
 			Severity:    SeverityHard,
 			Source:      "provisioner.go applyHostConfig T4 branch (case 4)",
 		},
@@ -169,7 +169,7 @@ func T4PrivilegeContract() []T4Capability {
 		{
 			Name:        "pid_host_visible",
 			Description: "Host PID namespace is shared (--pid=host). The container can see host process 1 (systemd or pid-1 on the EC2 instance). Required for nsenter into host mount/pid namespaces.",
-			Probe:       `[ -d /proc/1/root ] && [ "$(sudo -n readlink /proc/1/ns/pid)" = "$(sudo -n readlink /proc/self/ns/pid)" ]`,
+			Probe:       `sudo -n test -d /proc/1/root && [ "$(sudo -n readlink /proc/1/ns/pid)" = "$(sudo -n readlink /proc/self/ns/pid)" ]`,
 			Severity:    SeverityHard,
 			Source:      "provisioner.go applyHostConfig T4 branch (case 4): hostCfg.PidMode = 'host'",
 		},