Give run0 privileges to user1 (an admin) as root?

All that run0 does is kick off polkit authorization to check whether the process authenticated by you typing in a password is allowed to do the specified action, namely executing the specified command as superuser.

So, yes, configuring polkit is what you need to do if you want to change what polkit allows. In the simplest case, the group membership of user1 (to, say, the wheel group on redhatoids, or to the sudo group on some other distros) is enough to allow them to execute anything.

Here's polkit's manual on what polkit is and how to write a rule. You might have done it incorrectly; it works, and you can write pretty arbitrarily fine-grained rules on who can do what (not only in terms of org.freedesktop.policykit.exec) as what user with which arguments and environments.

Ah, and to cite polkit itself, because you really seem to be going down a security paranoia instead of a security conscious and restrictive path:

DON'T use polkit unless you actually have to. In other words, not every single privileged program providing service to unprivileged programs has to use polkit. For example, if you have a small well-written setuid helper to help deal with some implementation-detail of the OS (such as elevating the priority of the sound server process to real-time for console users) it's not really helpful to define a polkit action for this since, realistically, no-one is going to choose to not grant the privilege. Remember, a secure program is often one with little amount of code and few dependencies.

Yes, suid executables are a security risk. But let's be maybe a bit too frank here: your system has a user with superuser privileges that is human, and makes mistakes. Compared to your system's risk due to sudo vs run0 being exploited, I'd emphasize the risk of you running inadvisable commands through them. Especially since you have just caught yourself pasting javascript code that you don't seem to have the technological means to debug why it's not working into a root context. From an LLM, no less! These things are very well-known for having been trained on bad practices (and poisoning of even the biggest foundation models has been demonstrated in practice). Ask an LLM what to do when your web server can't deliver something, and they'll tell you, with a very high chance to "just set SELinux enforcement to off", giving the web server write access to your home directory and so on.

Advice: Before taking an action to improve the security of your system, you need to have a defined threat model, which explains why that action is a net security benefit. Adding complexity, or integrating code generated by an LLM, are very detrimental to the degree to which you can understand your system, and thus are typically not what you do, unless you have a very good reason to. "I've heard that A is generally better than B …" is not a "very good reasoning".