deploy/tests: add visudo syntax test for the sudoers drop-in

Pre-deploy syntax guard; replaces ckn-bw's per-item test_with which
won't apply to a symlink-delivered file (see deployment-responsibility
migration step 3).

deploy/tests/test_sudoers.py

@@ -0,0 +1,17 @@
+"""Syntax-check the sudoers drop-in via visudo before it leaves the repo."""
+import shutil
+import subprocess
+from pathlib import Path
+
+import pytest
+
+SUDOERS = Path(__file__).resolve().parents[2] / "deploy/files/etc/sudoers.d/left4me"
+
+
+@pytest.mark.skipif(shutil.which("visudo") is None, reason="visudo not installed")
+def test_sudoers_parses():
+    result = subprocess.run(
+        ["visudo", "-cf", str(SUDOERS)],
+        capture_output=True, text=True,
+    )
+    assert result.returncode == 0, f"visudo -cf failed: {result.stdout}{result.stderr}"