Backport #12380: Fix FreeBSD release job on root runners

[mergify]

The self-hosted FreeBSD runners execute jobs via act hostexecutor as root, where sudo is not installed. Run the privileged commands directly instead.

https://github.com/haskell/cabal/actions/runs/36233106929/job/108405358285

⭐ Run Main Install Node
/root/.cache/act/2b63ad1e4112c5fd/act/workflow/__run.sh: line 2: sudo: command not found
Error:   ❌  Failure - Main Install Node
Error: exit status 127

---

Template B: This PR does not modify behaviour or interface

E.g. the PR only touches documentation or tests, does refactorings, etc.

Include the following checklist in your PR:

• Patches conform to the coding conventions.
• Is this a PR that fixes CI? If so, it will need to be backported to older cabal release branches (ask maintainers for directions).

---

This is an automatic backport of pull request #12380 done by [Mergify](https://mergify.com).

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-09-28 07:56 UTC · Rule: default · triggered by rule Put backports in the rebase+merge queue
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-09-28 08:07 UTC · at ddd7f9e293fbe87a69472b06dc2434918af5ad86 · merge

This pull request spent 10 minutes 42 seconds in the queue, including 2 seconds running CI.

Required conditions to merge

• #review-threads-unresolved = 0 [🛡 GitHub branch protection]
  • Backport #12380: Fix FreeBSD release job on root runners #12389
• github-review-approved [🛡 GitHub branch protection]
  • Backport #12380: Fix FreeBSD release job on root runners #12389
• any of [🛡 GitHub branch protection]:
  • check-success = Doctest Cabal
  • check-neutral = Doctest Cabal
  • check-skipped = Doctest Cabal
• any of [🛡 GitHub branch protection]:
  • check-success = Meta checks
  • check-neutral = Meta checks
  • check-skipped = Meta checks
• any of [🛡 GitHub branch protection]:
  • check-success = Validate post job
  • check-neutral = Validate post job
  • check-skipped = Validate post job
• any of [🛡 GitHub branch protection]:
  • check-success = docs/readthedocs.org:cabal
  • check-neutral = docs/readthedocs.org:cabal
  • check-skipped = docs/readthedocs.org:cabal
• any of [🛡 GitHub branch protection]:
  • check-success = Bootstrap post job
  • check-neutral = Bootstrap post job
  • check-skipped = Bootstrap post job
• any of [🛡 GitHub branch protection]:
  • check-success = whitespace
  • check-neutral = whitespace
  • check-skipped = whitespace
• any of [🛡 GitHub branch protection]:
  • check-success = Check sdist post job
  • check-neutral = Check sdist post job
  • check-skipped = Check sdist post job
• any of [🛡 GitHub branch protection]:
  • check-success = Changelogs
  • check-neutral = Changelogs
  • check-skipped = Changelogs