deploy_data/deploy_app plays now run from INSIDE the forgejo-runner
container with ansible_connection=local, but the unprivileged runner's
root user (mapped to a high host UID) was being rejected by the incus
daemon — \"You don't have the needed permissions to talk to the incus
daemon\".
runner-grant-incus.sh: privileged + nesting + raw.idmap=\"both 0 0\"
so root inside the runner = root on the host. The mounted incus socket
becomes fully usable. One-shot script; idempotent.
Threat-model note in the script header: we accept this because the
deploy workflow already has incus-admin scope via socket+nesting, and
the trigger surface is gated to push:main + workflow_dispatch (no fork
PRs).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
