NOPASSWD exists in sudoers but a later include quietly overrides it

An admin entry is present, yet the operator is still prompted because include order means a later rule wins.