fix: simplify dashboard and disable unauthorized actions

internal/apt/apt.go

@@ -130,6 +130,14 @@ func (a *Adapter) Confirmation(bool) string { return "" }
 
 // DiagnosticChecks observes the APT command, configuration schema, and current
 // filesystem authority without changing the overlay or effective settings.
+func (a *Adapter) MutationAuthority(context.Context) target.Check {
+	check := target.ReadOnlyWriteAuthority(a.configuration.OverlayFile)
+	if !check.OK {
+		check.Evidence += "; run proxyctl with sufficient authority (normally sudo proxyctl)"
+	}
+	return check
+}
+
 func (a *Adapter) DiagnosticChecks(ctx context.Context, _ *profile.Profile) []target.Check {
 	commandCheck := target.Check{Name: "required command", OK: true, Evidence: "apt-config is available"}
 	command, err := a.runner.LookPath("apt-config")