Fix user ownership bug

diskless.pkr.hcl

@@ -293,7 +293,16 @@ build {
   # --- 4. Assemble + sign the UKI; build the OCI release-artifact image ----
   post-processor "shell-local" {
     inline = [
-      "NVMET_TRADDR='${var.nvmet_traddr}' bash scripts/extract-artifacts.sh output-qemu/diskless-build.qcow2 ${var.artifact_dir}/${var.image_version} ${var.disable_dot1x}",
+      # extract-artifacts MUST run as root so tar/mkfs.erofs preserve the build
+      # tree's real ownership (root:ssh_keys, tty/crontab setgid groups, user
+      # home dirs) — we dropped mkfs.erofs --all-root, which used to mask this by
+      # flattening everything to root:root. sudo is a no-op if already root, and
+      # the runner has passwordless sudo (cf. the `sudo apt-get` install step).
+      "sudo bash -c \"NVMET_TRADDR='${var.nvmet_traddr}' bash scripts/extract-artifacts.sh output-qemu/diskless-build.qcow2 ${var.artifact_dir}/${var.image_version} ${var.disable_dot1x}\"",
+      # Hand the OUTPUT FILES back to the build user (their in-erofs ownership is
+      # already baked correctly) so build-oci.sh can write the UKI and push with
+      # the build user's `buildah login`.
+      "sudo chown -R \"$(id -u):$(id -g)\" ${var.artifact_dir}",
       "bash scripts/build-oci.sh ${var.artifact_dir}/${var.image_version} ${var.oci_image} ${var.image_version} '${var.sb_key}' '${var.sb_cert}' ${var.oci_push}",
     ]
   }