Remove sudo -u cm wrapper that was causing git repository ownership mismatch. Now cm-agent runs nixos-rebuild directly as root, avoiding the ownership conflict between cm-agent (git clone) and cm user. Updated sudo rules to allow cm-agent -> root nixos-rebuild access.