postinst: make sure file permissions aren't severely broken

notably the case right now where our shadow build broke things

mkosi.postinst.chroot

@@ -6,6 +6,12 @@ set -ex
 
 env
 
+# Safety nets to prevent excessive breakage
+## sudo should have sticky bit set
+[ -u /usr/bin/sudo ] || exit 1
+## newuidmap should have a capability set
+[ "$(getcap /usr/bin/newuidmap)" != "" ] || exit 1
+
 mkdir --mode 0700 /system # for the kde-linux-overlay.service
 
 export SYSTEMD_ESP_PATH="$BOOT_MNT"