fix: avoid sudo argument false positives

[Eljees]

Summary

• report sudo only when it appears in a shell command position
• ignore occurrences used as ordinary arguments, such as find -iname sudo
• keep detecting direct calls, shell-wrapped calls, and calls after command separators

Root cause

useSudo treated any token equal to sudo as an executed command. This produced DKL-DI-0001 findings when an image build merely referenced the filename, including commands that delete the binary.

Testing

• go test ./pkg/assessor/manifest -count=1
• go vet ./pkg/assessor/manifest

Fixes #278