Issue Deduplicator fallback pass fails with `Unexpected: passwordless sudo not available`

What issue are you seeing?

The "Issue Deduplicator" workflow failed on a fallback duplicate-check pass due to sudo handling.

Run: https://github.com/openai/codex/actions/runs/22559224069
Job: https://github.com/openai/codex/actions/runs/22559224069/job/65342257505

In Identify potential duplicates:

1. Find duplicates (pass 1, all issues) succeeds and applies safety-strategy: drop-sudo.
2. Find duplicates (pass 2, open issues) runs in the same job and tries drop-sudo again.
3. It fails with:

Error: Unexpected: passwordless sudo not available.
    at ensurePasswordlessSudo (...)
    at async dropSudo (...)

This appears unrelated to the issue content itself (#13200) and is a workflow/runtime bug.

What steps can reproduce the bug?

1. Trigger the Issue Deduplicator workflow by creating a new issue.
2. Let pass 1 complete with no confident duplicates so fallback pass 2 is executed.
3. Observe pass 2 in the same job (Find duplicates (pass 2, open issues)).
4. The step fails with Unexpected: passwordless sudo not available.

Repro context from the failing run:

• Workflow: Issue Deduplicator
• Runner: ubuntu-latest (GitHub-hosted)
• Run: 22559224069
• Job: 65342257505

What is the expected behavior?

Fallback pass 2 should run successfully.

If sudo was already dropped in pass 1, pass 2 should not fail because of that state.
drop-sudo should be idempotent (or pass 2 should run in a fresh job/runner).

Additional information

_No response_