Sudo: Grant a Limited NOPASSWD Privilege

A service operator account needs to run exactly one administrative command via sudo without being prompted for a password — and nothing more. Read /root/case/assignment.env for the account name (OPUSER) and the one absolute command path it may run (CMD). Create a sudoers drop-in under /etc/sudoers.d/ that grants that account NOPASSWD access limited to that single command, and make sure the sudo configuration still parses cleanly (a syntax error in sudoers can lock everyone out). Grading reads the durable sudoers policy, so the drop-in is what must be correct.