fix(user-mapping): don't chown the workspace to root (corrupts host repo)

[pofallon]

Problem

Running the test suite kept flipping /workspaces/deacon to root:root ownership, and it came back after every fix.

Root cause

deacon up bind-mounts the host workspace into the container. Per the git-root mount default, an in-repo workspace folder resolves to the git root (/workspaces/deacon), so the whole repo gets mounted. Then user_mapping::set_workspace_ownership runs chown <uid>:<gid> <workspaceFolder> as root inside the container whenever a remoteUser is set (needs_user_mapping() = remote_user.is_some()). The feature-and-dotfiles / single-container fixtures set "remoteUser": "root", so it did chown 0:0 /workspace — which, on a bind mount, rewrites the host repo dir to root:root. The up_prebuild tests run for real in the docker integration job, so it recurred every run.

Fix (two layers)

1. Production guard (crates/core/src/user_mapping.rs): skip the workspace ownership adjustment when the target user is root (uid 0) — chowning to root is pointless (root already has full access) and actively corrupts host ownership on bind mounts. Non-root users still get the adjustment. Adds test_workspace_ownership_skipped_for_root and test_workspace_ownership_adjusted_for_nonroot. This protects real users and canaries, not just tests.
2. Hermetic tests (up_prebuild.rs, up_dotfiles.rs): copy fixtures into a TempDir outside the repo and run up there, so the git root is never mounted regardless. Drops the now-obsolete git-root .devcontainer-state cleanup.

integration_up_with_features.rs already passed --mount-workspace-git-root=false; no other in-repo up tests were unguarded.

Verification

• cargo test -p deacon-core --lib user_mapping — 17 passed (incl. both new tests).
• cargo nextest run -E 'binary(=up_prebuild)' — 8 passed; no root-owned artifacts created in /tmp or the repo during the run (TempDirs were created and cleaned by the unprivileged test user, proving no chown fired).
• cargo fmt --all -- --check and cargo clippy --all-targets --all-features -- -D warnings clean.

Note: the repo dir is currently still root:root from earlier (pre-fix) runs; a one-time sudo chown -R vscode:vscode /workspaces/deacon is needed, after which it will stay correct.

🤖 Generated with Claude Code