Fix #13: ensure /etc/sudoers includes /etc/sudoers.d