fix: clarify NoNewPrivileges handling in audit-webhook.service

backend/deploy/audit-webhook.service

@@ -17,7 +17,17 @@ RestartSec=5
 # Unlike audit-endpoint.service, this one genuinely needs to write to the
 # checkout (git reset --hard, npm install), hence ReadWritePaths below -
 # everything else stays as locked down as the main service.
-NoNewPrivileges=true
+#
+# NoNewPrivileges is deliberately NOT set here, unlike audit-endpoint.service:
+# it flips the kernel's PR_SET_NO_NEW_PRIVS flag, which makes setuid bits
+# (including /usr/bin/sudo's) inert for this process and everything it execs.
+# deploy.sh's whole reason for running as this user is to call
+# `sudo systemctl restart audit-endpoint` - a privilege escalation that is
+# exactly what that flag exists to prevent. The two are fundamentally
+# incompatible, not a configuration mistake to work around.
+# The actual containment for that escalation is the narrow sudoers rule
+# (audit-deploy-sudoers): exactly two "systemctl restart <unit>" commands,
+# nothing else, regardless of this flag.
 PrivateTmp=true
 PrivateDevices=true
 ProtectSystem=strict