doctor's config-syntax dry-build check drops the unnecessary sudo prefix — dry-build never activates, so it needs no more privilege than reading config (NINA-013); verified by code inspection only, no VM golden doctor test harness exists to extend

@@ -1657,11 +1657,14 @@16571657     // Check config syntax. Flake-aware like apply/upgrade: on a flake system a16581658     // plain `nixos-rebuild dry-build` evaluates <nixpkgs/nixos> + <nixos-config>16591659     // (channel style) and fails, so pass --flake when the config dir has one.1660+    // No sudo: dry-build only evaluates + builds, it never activates, so it1661+    // needs no more privilege than reading the config and talking to the nix1662+    // daemon over its (world-writable) socket — unlike switch/activate below.16601663     {16611664         const argv: []const []const u8 = if (useFlakeFlag(gpa, io, machine))1662-            &.{ "sudo", "nixos-rebuild", "dry-build", "--flake", machine.config_path }1665+            &.{ "nixos-rebuild", "dry-build", "--flake", machine.config_path }16631666         else1664-            &.{ "sudo", "nixos-rebuild", "dry-build" };1667+            &.{ "nixos-rebuild", "dry-build" };16651668         const r = try capture(gpa, io, machine, argv);16661669         defer gpa.free(r.stdout);16671670         defer gpa.free(r.stderr);