Azure CycleCloud 8.9.1 Jetpack installs /etc/sudoers.d/cyclecloud with mode 0400, which AlmaLinux 9 rejects

## Summary

Azure CycleCloud 8.9.1 Jetpack installs `/etc/sudoers.d/cyclecloud` with file mode `0400`.

On AlmaLinux 9, `visudo -c` rejects this file and reports that it should have mode `0440`. This (might?) prevent the `cyclecloud` group sudo rule from being accepted.

## Environment

- Azure CycleCloud: 8.9.1
- Node OS: AlmaLinux 9
- Cluster type: Slurm
- Slurm project version: 4.0.9

## Expected behaviour

Jetpack should install `/etc/sudoers.d/cyclecloud` with permissions accepted by `sudo` and `visudo` on supported distributions.

Expected mode on this system:

```text
0440
```

## Actual behaviour

Jetpack installs the file with mode `0400`.

The Jetpack install log shows:

```text
Copied file: /etc/sudoers.d/cyclecloud
Changed file ownership for: /etc/sudoers.d/cyclecloud (root:root)
Changed file permissions for /etc/sudoers.d/cyclecloud (0x400)
```

The installed Jetpack code explicitly uses `0o400`:

```python
copy_file(
_filepath('cyclecloud'),
'/etc/sudoers.d/cyclecloud',
'root',
'root',
0o400
)
```

`visudo -c` reports:

```text
/etc/sudoers.d/cyclecloud: bad permissions, should be mode 0440
```

The file contains:

```text
%cyclecloud ALL=(ALL) NOPASSWD:ALL
Defaults:%cyclecloud !requiretty
```

## Workaround

```bash
chown root:root /etc/sudoers.d/cyclecloud
chmod 0440 /etc/sudoers.d/cyclecloud
restorecon -v /etc/sudoers.d/cyclecloud
visudo -c
```

After changing the mode to `0440`, validation succeeds:

```text
/etc/sudoers.d/cyclecloud: parsed OK
```

## Requested investigation

Please investigate whether Jetpack should install `/etc/sudoers.d/cyclecloud` as `0440` instead of `0400` on AlmaLinux 9 and other supported Linux distributions.

Start by locating the Jetpack code that calls copy_file for /etc/sudoers.d/cyclecloud with mode 0o400. Check how the file mode is selected for supported Linux distributions and validate the result with visudo -c on AlmaLinux 9. Done means the installed file uses permissions accepted by visudo, including the expected 0440 mode.

Written by the indexing model from the issue text.