Use sudo for chsh so it works in non-interactive chezmoi runs

chsh asks for the user's password by default (PAM authentication).
In an interactive SSH session this works fine; in a non-interactive
chezmoi run it fails with 'PAM: Authentication failure' because
there's no TTY to prompt.

sudo chsh works because the script has already cached sudo
credentials via earlier 'sudo apt-get install' / 'sudo pacman'
calls in the same script run.

Crouton bootstrap was failing here after font install + neovim +
oh-my-zsh all succeeded — wasted ~10 minutes of bootstrap just for
the chsh step.

run_once_20-install-user-packages.sh.tmpl

@@ -198,7 +198,7 @@ fi
 USER_SHELL="$(getent passwd "$(whoami)" | cut -d: -f7)"
 if [[ "$USER_SHELL" != "$(command -v zsh)" ]]; then
     log "changing login shell to zsh"
-    chsh -s "$(command -v zsh)"
+    sudo chsh -s "$(command -v zsh)" "$(whoami)"
 else
     log "zsh already the login shell"
 fi