I'm a damn idiot who has spent two days on this.
's/sudoRule/sudoRole/'
.... and of course mapping against that _real_ objectClass now means it works:
# sudo -U nuser1 -ll Matching Defaults entries for nuser1 on testclient: env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin, use_pty
User nuser1 may run the following commands on testclient:
LDAP Role: ssh RunAsUsers: root Commands: ALL
... don't mind me. I'll go and hide under my rock again.