stack-down.sh --wipe aims sudo virsh at an operator-owned session socket

The `--wipe` reap in `stack-down.sh:83-84` aims `sudo virsh` at an operator-owned session socket.

## The mismatch

`deploy/systemd/README.md` records the runtime ownership: the session socket belongs to the operator account, not to root. Reaching it with `sudo` is the wrong privilege for that URI — a session connection is owned by the user who runs it.

No exploit is demonstrated and none is claimed. This is filed as a privilege-shape defect: the command asks for root to reach something root does not own, which either fails or succeeds for reasons nobody intended.

## Acceptance

- The reap reaches the session URI with the privilege that owns it.
- Or the ownership model is restated so that `sudo` is correct there, and the README is updated to match.

Found during the #2480 security review pass.

Inspect the --wipe reap at stack-down.sh:83-84 and compare its virsh invocation with the ownership model documented in deploy/systemd/README.md. Verify which account owns the session socket and how the command behaves with and without sudo. Done means the reap reaches the session URI with its owning privilege, or the ownership model and README consistently justify sudo.

Written by the indexing model from the issue text.