Add sudo password prompt alerts

[ilysenko]

Summary

• add opt-in CODEX_SUDO_ALERT=1 notifications immediately before interactive sudo authentication
• prefer PipeWire/PulseAudio desktop sounds with canberra, ALSA, and terminal-bell fallbacks
• route native package installation and dependency bootstrap through the shared fail-safe wrapper
• document the option and cover cached credentials, failures, ordering, and Make wiring

Tests/checks

• bash -n scripts/sudo-with-alert.sh scripts/install-deps.sh tests/scripts_smoke.sh
• git diff --check
• dry-runs for make install, install-native, bootstrap-native, and update-native
• bash tests/scripts_smoke.sh
• manual PipeWire sound verification before a real sudo password prompt

Notes

The feature is disabled by default. Missing or failing audio backends do not block sudo or change the privileged command status.