# Managed by the transcoder-node .deb — the node agent controls the per-channel
# transcoder-ffmpeg@ worker units. Scoped to the systemctl BINARY (sudoers can't
# safely constrain args); same single grant as deploy/provision.sh. Validated by
# the .deb postinst (visudo -cf).
esto  ALL=(root) NOPASSWD: /usr/bin/systemctl
