guest: require sudo with /etc/sudoers.d support