fix: avoid sudo argument false positives

[Eljees]

Summary

• report sudo only when it appears in a shell command position
• ignore occurrences used as ordinary arguments, such as find -iname sudo
• keep detecting direct calls, shell-wrapped calls, and calls after command separators

Root cause

useSudo treated any token equal to sudo as an executed command. This produced DKL-DI-0001 findings when an image build merely referenced the filename, including commands that delete the binary.

Testing

• go test ./pkg/assessor/manifest -count=1
• go vet ./pkg/assessor/manifest

Fixes #278

[Eljees]

Ping — this one and #319 and #320 have been open since 27 July with no review.

They are independent single-package fixes, each with a test:

• fix: avoid sudo argument false positives #318 — useSudo treated any token equal to sudo as an executed command, so DKL-DI-0001 fired when an image merely referenced the filename (find -iname sudo, or a command deleting the binary). Now it reports only when sudo is in command position.
• fix: fall back after image transport init failure #319 — Dockle tries docker-daemon: before docker://. For a locally pulled image referenced by its registry manifest digest the daemon source opens but image.FromSource rejects the reconstructed manifest, and newSource returned that error instead of trying the registry transport already in the fallback list.
• fix: honor standard Docker host environment #320 — the documented GitLab dind setup exports DOCKER_HOST, which Dockle never read, so it could not see the locally built image. Explicit --host and DOCKLE_HOST keep their precedence.

No CI has run on any of the three: the check suites for 715d6f0, af97950 and cacd6e2 are all sitting at action_required with zero runs, so a maintainer needs to approve the workflow before anything can go green.

Happy to close any of them if they are not wanted.