A sudo MFA rule works for direct users and fails for SSH jump users

Local sudo still prompts correctly, yet one access path bypasses or breaks MFA because PAM flow ordering changed in the updated stack.