fix(ci): run hub-check sandbox proof as unprivileged user

agent-sandbox-linux requires uid>0, CapEff=0, and NoNewPrivs=1. Act runners
often execute as root with residual caps; create cphci and drop privileges
via setpriv before vitest.

.gitea/workflows/hub-check.yml

@@ -111,13 +111,29 @@ jobs:
         run: |
           cd ..
           cargo install --path crates/cph-cli --locked
+          # Make cph available to the unprivileged sandbox user below.
+          sudo install -m 0755 "$HOME/.cargo/bin/cph" /usr/local/bin/cph
 
       - name: Prove real Claude SDK Bash sandbox boundary
         run: |
-          sudo install -d -o "$(id -u)" -g "$(id -g)" -m 0700 /w/t
+          set -euo pipefail
-          CPH_SANDBOX_TEST_ROOT=/w/t \
+          # The proof requires uid>0, CapEff=0, NoNewPrivs=1. Gitea act often
-            /usr/bin/setpriv --no-new-privs \
+          # runs the job as root; drop to a dedicated user with emptied caps.
-            npx vitest run test/integration/agent-sandbox-linux.test.ts
+          if ! id cphci >/dev/null 2>&1; then
+            sudo useradd --create-home --shell /bin/bash cphci
+          fi
+          sudo install -d -o cphci -g cphci -m 0700 /w/t
+          REPO_ROOT="$(cd .. && pwd)"
+          # Vitest/node_modules must be readable by cphci.
+          sudo chown -R cphci:cphci "$REPO_ROOT/hub"
+          sudo -u cphci env \
+            HOME="/home/cphci" \
+            PATH="/usr/local/bin:/usr/bin:/bin" \
+            CPH_SANDBOX_TEST_ROOT=/w/t \
+            /usr/bin/setpriv \
+              --reuid=cphci --regid=cphci --clear-groups \
+              --inh-caps=-all --bounding-set=-all --no-new-privs \
+              bash -lc "cd '$REPO_ROOT/hub' && npx vitest run test/integration/agent-sandbox-linux.test.ts"
 
       - name: Run unit tests
         run: npx vitest run test/unit