refactor(pm): prompt for sudo only when the repair would use it

The update warm-up resolved sudo on its own, so on a glibc host with no
supported package manager it still asked for a password the repair then
never used. Derive the prompt from the same _host_install_command and
_command_plan the repair runs, compute the target once, and correct the
module docstring now that there are two entry points.

pm/libatomic.py

@@ -1,6 +1,8 @@
 """Install the host libatomic package required by official Linux Node.
 
-This module is intentionally called only from PM's staged-install repair hook.
+Two entry points: warm_sudo_before_install() lets an interactive update cache
+a sudo ticket before PM takes its install lock, and try_install_libatomic()
+is the non-interactive repair run from Nodejs.repair_staged_verification().
 Package verification itself remains diagnostic and side-effect free.
 """
 
@@ -103,16 +105,22 @@ def warm_sudo_before_install() -> None:
         return
     if not (sys.stdin and sys.stdin.isatty() and sys.stdout and sys.stdout.isatty()):
         return
-    if current_target() in MUSL_TARGETS or current_target().endswith("-bionic"):
+    target = current_target()
+    if target in MUSL_TARGETS or target.endswith("-bionic"):
         return
     try:
         ctypes.CDLL("libatomic.so.1")
         return
     except OSError:
         pass
-    sudo = shutil.which("sudo")
-    if sudo is None or subprocess.run([sudo, "-n", "true"], stdin=subprocess.DEVNULL,
-                                      capture_output=True, check=False).returncode == 0:
+    # Prompt only when the repair would actually run sudo with the ticket.
+    command = _host_install_command()
+    argv = _command_plan(command)[0] if command else None
+    if not argv:
+        return
+    sudo = argv[0]
+    if subprocess.run([sudo, "-n", "true"], stdin=subprocess.DEVNULL,
+                      capture_output=True, check=False).returncode == 0:
         return
     print("→ Node.js needs libatomic.so.1; sudo may ask for your password to install it", flush=True)
     try:

tests/fixtures/resolution_allowlist.json

@@ -439,11 +439,6 @@
     "symbol": "_host_install_command",
     "kind": "bare_which"
   },
-  {
-    "path": "pm/libatomic.py",
-    "symbol": "warm_sudo_before_install",
-    "kind": "bare_which"
-  },
   {
     "path": "pm/native_build.py",
     "symbol": "prepare_windows_environment",