Fix user ownership bug

docs/TODO.md

@@ -223,6 +223,17 @@ boot LAN.
     build-time assertion that `/usr/bin/bash` is labeled before `mkfs.erofs`
     (mkfs.erofs preserves xattrs). Needs `attr` on the build host. The image now
     boots **enforcing**.
+  - **`mkfs.erofs --all-root` was flattening all ownership to root:root.** Mode
+    bits + (now) xattrs survive the export, but `--all-root` forced every inode
+    to uid/gid 0 — discarding group ownership (`ssh_keys` on host keys →
+    sshd "permissions 640 too open" → refused; `tty`/`crontab` setgid groups)
+    and user ownership (home dirs). **Fixed:** dropped `--all-root` so real
+    ownership is preserved from the tree. That now requires `extract-artifacts.sh`
+    to run as **root** (added an `id -u` guard; `tar -x` needs CAP_CHOWN to
+    restore ownership) — the post-processor runs it via `sudo` and `chown`s the
+    output files back to the build user so `build-oci.sh` (rootless buildah +
+    its own login) still works. Combined with the host-key strip above, sshd
+    starts cleanly.
     **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire