Address review findings on the system-install PR:
- cloud_sink: honor SUDO_USER for audit attribution only when euid==0.
Without the gate any user could set SUDO_USER and spoof cloud-audit
attribution to another account. Matches the guard in cmd/setup/cert.go.
- config: divert per-user paths to root's passwd home only on an actual
sudo elevation (euid==0 && SUDO_USER set), not for every root euid.
The blanket root diversion ignored HOME/XDG_CONFIG_HOME and silently
stopped reading genuine root users' config (golden Docker images),
regressing two tests that only fail when the suite runs as root.
Genuine root honors the environment as before; su without - leaves no
marker and stays a documented, loud-failing residual.
- doctor: add a system-only check re-validating that the binary the
installed shims exec is still root-owned and non-writable, catching
permission/ownership drift after install.
- shim: fold the duplicated shim-scan loop into firstShimContent.
Running as uid 0 without a resolvable root passwd entry (scratch
containers, minimal chroots) panicked at startup on every command,
because the euid-based path resolution had no fallback. Fall back to
env-derived resolution there: without a passwd database there is no
user switching, so the cross-user poisoning that branch prevents
cannot occur.
Also restore the underlying cause in the generic event-log init error
(minimal output hid it after the usefulerror change), and document
that root's per-user data lives under /root regardless of a preserved
HOME.
Path resolution trusted HOME (and XDG_*), which sudo and su can preserve
from the invoking user (GitHub runners, sudo -E, su without -). Any pmg
run as root then created root-owned ~/.config/safedep inside that user's
home, and event-log init fail-closed every later non-root pmg/npm/pip
run for them. System install made sudo pmg the documented flow, turning
this latent bug into the happy path.
When euid is 0, configDir and cacheDir now resolve from root's passwd
home instead of the environment, so root state lands under /root and
user homes are never touched. PMG_CONFIG_DIR/PMG_CACHE_DIR still win,
non-root resolution is unchanged, and Windows is unaffected (no euid).
Event-log init stays fatal on failure; sudo-run package events are
attributed via SUDO_USER and synced by the exit auto-sync as usual.
E2E: GitHub runners preserve HOME under sudo, so assert that no sudo
pmg run leaks state into the runner's home, and that the managed-config
refusal fails for the documented reason rather than a permission brick.
Sahilb315