If your command doesn't change (doesn't require dynamic input), sudoers file can make specific command+argument run without password required.

https://www.cyberciti.biz/faq/linux-unix-running-sudo-command-without-a-password/ (ctrl+f search "A better solution")

(You can also use wildcards in sudoers file but with nftables I imagine it's a big security risk)

2. Is the usual solution, but instead of file use unix socket and user/group permissions as auth - the running user has to be part of some group so that the control client (A) can access the control socket of (B) daemon.

Alternatively you could use capabilities:

https://stackoverflow.com/a/414258

https://man7.org/linux/man-pages/man7/capabilities.7.html

You could try pkexec insted of sudo. Pkexec pops up the password prompt in a window insted of prompting in the terminal.

Method 2 could use inotify to wake up when the file changes. It wouldn't have to poll. Method 3 could launch from inetd so it wouldn't have to always be running if these events are infrequent.

Have you looked into the suid bit? You can set it on the file, then change the script owner to root and it runs in elevated mode: https://linuxhandbook.com/suid-sgid-sticky-bit/