the solution ended up being fairly simple (use a real user and write a short polkit rule) but i tried a lot of other things along the way 😅 https://github.com/haku/esphome-host-exec/?tab=readme-ov-file#allowing-agent-to-call-shutdown