discover: sudo RTK_DISABLED=1 … is not counted as a bypass when sudo is a transparent prefix #3756

Summary

Since #2810 the hook no longer rewrites sudo … (see #146): rtk rewrite "sudo docker ps" prints nothing. So in a default configuration sudo RTK_DISABLED=1 docker ps is not a missed saving — dropping the RTK_DISABLED=1 recovers nothing — and rtk discover / rtk gain are right not to count it. They report it as an unhandled sudo … command, which is what it is.

It becomes a real bypass only when the user declared the wrapper transparent (hooks.transparent_prefixes = ["sudo", "sudo -E"]): then sudo docker ps does rewrite, and sudo RTK_DISABLED=1 docker ps is recoverable savings that rtk discover currently misses, because strip_disabled_prefix never sees an RTK_DISABLED= that sits after the wrapper.

What a fix should do

• Detect the assignment behind a wrapper with an analytics-only peel. strip_disabled_prefix stays as it is: it is shared with the rewrite path (rewrite_segment_inner), and putting sudo back into it reintroduces the sudo rtk … rewrite fix(rewrite): stop rewriting sudo commands (pass them through) #2810 removed.
• Judge it with would_be_covered_without_bypass, asked about the line the user typed minus the RTK_DISABLED= assignment — wrapper included. Asking about the peeled remainder (docker ps) answers for a command that was never run and reports savings that do not exist.
• Leave gain's cmd_has_rtk_disabled_prefix on the syntactic check: its warning has no coverage gate (gain: RTK_DISABLED bypass warning counts commands the hook would not have rewritten anyway #4277), so a wrapper-aware peel there can only inflate the percentage.

Tests

• default config: sudo RTK_DISABLED=1 docker ps and sudo -E RTK_DISABLED=1 docker ps → not counted by discover or gain
• transparent_prefixes = ["sudo", "sudo -E"]: both → counted by discover
• RTK_DISABLED=1 docker ps → still counted (regression guard)
• strip_disabled_prefix("sudo RTK_DISABLED=1 docker ps") still returns an empty prefix, pinning that the shared helper did not change

Related: #4278 covers the wrappers the hook does rewrite through by default (nice, timeout, command), which are genuinely uncounted today. Work in progress in #3808.