fix(firecracker): restore agent home ownership at boot

bot_bottle/agent_provider.py

@@ -271,6 +271,8 @@ class AgentProvider(ABC):
         # runtime, after every backend's copy/export path has completed.
         git_xdg_dir = f"{plan.guest_home}/.config/git"
         repair = bottle.exec(
+            f"chown node:node {shlex.quote(plan.guest_home)} && "
+            f"chmod 755 {shlex.quote(plan.guest_home)} && "
             f"mkdir -p {shlex.quote(git_xdg_dir)} && "
             f"chown -R node:node {shlex.quote(f'{plan.guest_home}/.config')} && "
             f"chmod -R u+rwX,go+rX {shlex.quote(f'{plan.guest_home}/.config')}",

bot_bottle/backend/firecracker/util.py

@@ -373,6 +373,12 @@ mount -o remount,rw / 2>/dev/null
 # scratch dirs there — git worktrees, build temp, `git init /tmp/...`, etc.
 mkdir -p /tmp && chmod 1777 /tmp
 
+# Rootfs export also maps the image's original owners to the unprivileged
+# host build uid. That uid is not guaranteed to be node's uid in the guest;
+# restore the home-directory boundary before any SSH provisioning runs.
+chown node:node /home/node 2>/dev/null || true
+chmod 755 /home/node 2>/dev/null || true
+
 # Install the per-bottle SSH pubkey from the kernel cmdline.
 KEY=$(sed -n 's/.*bb_pubkey=\([^ ]*\).*/\1/p' /proc/cmdline | base64 -d 2>/dev/null)
 if [ -n "$KEY" ]; then

tests/unit/test_docker_provision_git_user.py

@@ -135,6 +135,8 @@ class TestProvisionGitUser(unittest.TestCase):
             if "/home/node/.config/git" in call.args[0]
         )
         self.assertEqual("root", user)
+        self.assertIn("chown node:node /home/node", script)
+        self.assertIn("chmod 755 /home/node", script)
         self.assertIn("mkdir -p /home/node/.config/git", script)
         self.assertIn("chown -R node:node /home/node/.config", script)
         self.assertIn("chmod -R u+rwX,go+rX /home/node/.config", script)

tests/unit/test_firecracker_backend.py

@@ -61,6 +61,12 @@ class TestNetpoolSlots(unittest.TestCase):
 
 
 class TestNetpoolRenderers(unittest.TestCase):
+    def test_guest_init_restores_node_home_boundary(self):
+        from bot_bottle.backend.firecracker import util
+
+        self.assertIn("chown node:node /home/node", util._GUEST_INIT)
+        self.assertIn("chmod 755 /home/node", util._GUEST_INIT)
+
     def test_nixos_module_is_non_invasive(self):
         # The NixOS module must NOT flip the host firewall backend or
         # hand interfaces to systemd-networkd; it brings the pool up via