fix: sudo -n, SSH env passthrough, filepath.Clean for destDir

[Copilot]

Three robustness issues in the rolling-update tooling identified in code review.

Changes

scripts/rolling-update.sh

• sudo -n everywhere — replaced bare sudo with sudo -n (non-interactive, fail-fast). Added require_passwordless_sudo guard that runs before any privileged operation and emits an actionable error if NOPASSWD sudo is not configured, preventing indefinite blocking over SSH.

• SSH env variable passthrough — changed ssh ... VAR=value 'bash -s' to ssh ... env VAR=value bash -s. The original form relies on the remote login shell accepting POSIX VAR=value prefix syntax, which non-POSIX shells (e.g. fish) reject before bash ever runs.

# before — breaks if remote login shell is fish or similar
ssh "$target" FOO=bar 'bash -s' <<'REMOTE'

# after — shell-agnostic
ssh "$target" env FOO=bar bash -s <<'REMOTE'

internal/raftstore/migrate.go

• filepath.Clean(destDir) — normalize destDir before constructing the .migrating temp path. Without this, a caller-supplied trailing slash (e.g. /path/raft.db/) produces a nested temp dir (/path/raft.db/.migrating) instead of a sibling (/path/raft.db.migrating), causing os.Rename to fail at finalization.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.