The only reason a port will need sudo during build is to "detect" that it exists and work with it when being installed.
There will never be a port that only needs sudo during its build when it's not needed during its runtime.
A port must be buildable as a user, so sudo is of absolutely no use, also, ports are built as nobody, and nobody is not in sudoers.

Another thing, only the build param is needed, the run parameter should not exist, and the RUN_DEPENDS should always be added.

In D51165#1189817, @arrowd wrote:

Are you fine with p.5? Zig distfiles get extracted twice at the moment. This can be fixed with introducing an opposite of EXTRACT_ONLY called EXTRACT_EXCEPT or EXTRACT_NOT. Would that be acceptable?

This looks fine. Maybe put the ZIG_TUPLE variable in a Makefile.tuple, and .sinclude it as it's done for cargo.