forked from EduCraft/curriculum-project-hub
3a46ebc54d
agent-sandbox-linux requires uid>0, CapEff=0, and NoNewPrivs=1. Act runners often execute as root with residual caps; create cphci and drop privileges via setpriv before vitest.