I had one remaining prompt in sys-whonix that didn’t show up when starting the template itself. To resolve it, /etc/sudoers.d/zz99 now contains both these lines:
ALL ALL=NOPASSWD: /usr/sbin/virt-what
ALL ALL=NOPASSWD: /usr/sbin/service whonixcheck *