feat(make): one-command install-powermetrics-sudo + uninstall targets

[Defilan]

Summary

Adds two Makefile targets so the NOPASSWD sudoers install for `--apple-power-enabled` is a one-liner instead of a 5-line shell incantation:

• `make install-powermetrics-sudo`
• `make uninstall-powermetrics-sudo`

Why

PR #334 shipped the Apple power gauges and a security-audited sudoers fragment, but the README install steps were:

```bash
TMP=$(mktemp)
sed "s/LLMKUBE_USER/$(whoami)/" deployment/macos/sudoers.d/llmkube-powermetrics > "$TMP"
sudo visudo -cf "$TMP"
sudo install -m 0440 -o root -g wheel "$TMP" /etc/sudoers.d/llmkube-powermetrics
rm "$TMP"
```

That's a friction wall for a feature most users will only ever opt into to feed InferCost. Make targets reduce it to one command without hiding anything: sudo still prompts (consent visible), the granted command is read back via `sudo -ln | grep powermetrics` so the operator can verify scope, and the README still documents the fully manual install for inspection.

What's in it

• New `install-powermetrics-sudo` target. Renders the `LLMKUBE_USER` placeholder for `whoami`, syntax-checks via `visudo -cf` (refuses to install malformed files rather than break sudo), atomically installs to `/etc/sudoers.d/llmkube-powermetrics` with `0440 root:wheel`, then echoes the granted command back so the operator can verify exactly what was authorized.
• New `uninstall-powermetrics-sudo` target. Single `sudo rm` plus a one-line note about what the agent will see going forward.
• README updated to lead with the make targets, with the manual install retained below for operators who want to inspect each step.

Privilege model

Unchanged. Pinned argv (`/usr/bin/powermetrics --samplers cpu_power,gpu_power -i [0-9]*` only), single binary, opt-in via `--apple-power-enabled` flag. The make target collapses keystrokes; it does not change what's granted.

Test plan

• `make help` shows both new targets in the Metal Agent section
• `make install-powermetrics-sudo` on a fresh M5 Max with no prior sudoers entry: prompts for password, validates syntax, installs file with correct mode/owner, echoes back the granted command
• `sudo -ln | grep powermetrics` shows the pinned-argv grant
• `make uninstall-powermetrics-sudo` removes the file cleanly
• Reviewers: run on your own Mac if you have one

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!