fix: address system-install review findings

- shim: make system executable resolution injectable so tests pass under
  umask 002; skip the root-owner test when running as root
- doctor: treat resolution into either the system or per-user shim dir as
  intercepted, and collapse the shim-in-PATH check to a single call site
- setup: make remove (both --system and per-user) best-effort with
  errors.Join so one failed step no longer strands the other artifact
- shim: allow a group-writable install parent dir (Debian/Ubuntu ship
  /usr/local/bin as root:staff 2775) while still rejecting world-writable
  and non-root-owned parents
- audit: attribute cloud events to SUDO_USER when running under sudo
- docs: drop the soft-fail event-logging claim (hard-fail is retained)

internal/audit/cloud_sink.go

@@ -95,8 +95,7 @@ func (s *cloudSink) buildInvocationContext() *controltowerv1.EndpointInvocationC
 	ctx.SetCommand(s.command)
 	ctx.SetWorkingDirectory(s.workingDir)
 
-	u, err := user.Current()
-	if err == nil {
+	if u := invokingUser(); u != nil {
 		ctx.SetUsername(u.Username)
 		ctx.SetUsernameUid(u.Uid)
 	}
@@ -119,6 +118,21 @@ func (s *cloudSink) buildInvocationContext() *controltowerv1.EndpointInvocationC
 	return ctx
 }
 
+// invokingUser resolves the human behind the command, preferring SUDO_USER so a
+// `sudo npm ...` is attributed to the operator rather than root.
+func invokingUser() *user.User {
+	if name := os.Getenv("SUDO_USER"); name != "" {
+		if u, err := user.Lookup(name); err == nil {
+			return u
+		}
+	}
+	u, err := user.Current()
+	if err != nil {
+		return nil
+	}
+	return u
+}
+
 func buildCommand(packageManager string, args []string) string {
 	if packageManager == "" {
 		return ""