Sudo access for package installation in worker images

Private worker images currently block access to apk, which makes it impossible to install additional packages at runtime. Not every deployment justifies maintaining a custom image.

From time to time, it is useful to install a small number of packages via hooks for a single stack or execution context. There is no supported way to do this when using private workers, which forces teams towards heavier image customisation than is really necessary.

Allowing limited sudo access, restricted specifically to apk, would address this gap.