A sudoers include grants the right command path while the shell wrapper now invokes a different binary via env indirection during a failover rehearsal

The human command looks the same and the executed path is not. Normal traffic masked the issue until the standby or alternate path became active under rehearsal conditions.