fix: run privileged commands on the exec channel, never typed into the shell

_sudo typed `echo '<password>' | sudo -S -p "" <command>` into netmiko's
interactive shell. bash kept it in its history, so every poll wrote the sudo
password into the login user's ~/.bash_history, and while the command ran it
was in the process list for every local user (NetOrk/netork#1039).

_sudo, _sudo_status and _run_privileged with a password now run on an exec
channel like run_command(privileged=True): the password reaches sudo -S on
stdin, there is no PTY to echo it, and the script starts with
`exec </dev/null` so a non-prompting sudo leaves it unread. The whole
command runs as root in one sh -c - before, only the part up to the first
`;`, `&&` or `|` did. The exit status comes from the channel.

The interactive session switches its history off before its first command.
get_vpn_tunnels with a password reads `wg show all dump` from the exec
channel instead of a temp file that held the private keys.

CHANGELOG.md

@@ -16,6 +16,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   (NetOrk/netork#1029). Stage the data without privilege and have root install
   that file. Without a sudo password (`sudo -n`) or for a root login, stdin
   still goes to the command.
+- The sudo password is no longer typed into the interactive shell
+  (NetOrk/netork#1039). Every privileged command ran there as
+  `echo '<password>' | sudo -S -p "" <command>`: bash kept it in its history,
+  so each poll wrote the password into the login user's `~/.bash_history`, and
+  while the command ran it was in the process list for every local user.
+  Privileged commands (`_sudo`, `_sudo_status`, and `_run_privileged` with a
+  sudo password) now run on an exec channel like `run_command(privileged=True)`:
+  the password reaches `sudo -S` on stdin, there is no PTY to echo it, and the
+  whole command runs as root in one `sh -c` (before, only the part up to the
+  first `;`, `&&` or `|` did, so `mv … && chown root:root …` failed its chown).
+  The interactive session also switches its history off before its first
+  command (` unset HISTFILE; set +o history`). **History files written before
+  this version may still hold the sudo password**: remove those lines from the
+  login user's `~/.bash_history` on your hosts and consider changing the
+  password. `_sudo_status` takes the exit status from the channel; it is `None`
+  only when the channel closed without one.
 
 ## [0.4.0] – 2026-10-08