A sudo rule works locally and fails through a bastion

A host update passes basic tests and later operators notice sudo MFA behaves differently only when entering through a jump host.