During a Linux post-exploitation phase, you gained root on an application server and, to maintain access, appended your public key to /root/.ssh/authorized_keys, added a systemd service that spawns a reverse shell on boot, and modified /etc/sudoers to grant a low-privilege service account NOPASSWD access. The engagement is now ending and the rules of engagement require you to restore the environment to its pre-test state. Which action is MOST important to include in your cleanup so the environment is not left in a weakened security posture?