fix(configuration): enable per-family time-sync and skip sudo-rs lecture

roles/configuration/tasks/banner.yml

@@ -42,25 +42,37 @@
 - name: Configure sudo banner
   when: system_cfg.features.banner.sudo | bool
   block:
-    - name: Create sudo lecture file
-      ansible.builtin.copy:
-        content: |
-          I am Groot, and I know what I'm doing.
-        dest: /mnt/etc/sudo_lecture
-        mode: "0644"
-        owner: root
-        group: root
+    - name: Detect the target sudo implementation
+      ansible.builtin.command: "{{ chroot_command }} /usr/bin/sudo --version"
+      register: configuration_sudo_version
+      changed_when: false
+      failed_when: false
 
-    - name: Enable sudo lecture in sudoers
-      ansible.builtin.lineinfile:
-        path: /mnt/etc/sudoers
-        line: "{{ item }}"
-        state: present
-        create: true
-        mode: "0440"
-        owner: root
-        group: root
-        validate: "/usr/sbin/visudo --check --file=%s"
-      loop:
-        - "Defaults lecture=always"
-        - "Defaults lecture_file=/etc/sudo_lecture"
+    # sudo-rs (Ubuntu 25.10+) implements neither `lecture` nor `lecture_file`
+    # and warns on every sudo call when they are set. It prints its version banner
+    # to stderr, not stdout, so match against both streams.
+    - name: Configure the sudo lecture
+      when: "'sudo-rs' not in (configuration_sudo_version.stdout ~ configuration_sudo_version.stderr)"
+      block:
+        - name: Create sudo lecture file
+          ansible.builtin.copy:
+            content: |
+              I am Groot, and I know what I'm doing.
+            dest: /mnt/etc/sudo_lecture
+            mode: "0644"
+            owner: root
+            group: root
+
+        - name: Enable sudo lecture in sudoers
+          ansible.builtin.lineinfile:
+            path: /mnt/etc/sudoers
+            line: "{{ item }}"
+            state: present
+            create: true
+            mode: "0440"
+            owner: root
+            group: root
+            validate: "/usr/sbin/visudo --check --file=%s"
+          loop:
+            - "Defaults lecture=always"
+            - "Defaults lecture_file=/etc/sudo_lecture"