Model runner depriv and deliver the unit fragment

[gunbai-bot]

Summary

• Model the facts a hand-placed depriv.conf carried: systemd User= from DeployRunnerPrincipal.unit_user, CTRL_RUNNER_JOB_USER from RunnerHostDeploy.job_user, CI sccache env from ci_cache_instance, DOCKER_HOST from extdeps.docker.endpoint docker_rootless_unix_endpoint.
• The job-user XDG uid used for the rootless socket is TranscribedUncited (read obligation: id -u of the job user). It is not fleet_posix_ci_runner_user.uid, which is recorded as the wrong number.
• runner_host_file_converge now delivers four files per host: the modeled fragment, the modeled depriv drop-in, the teardown drop-in, and the needrestart deferral. The fragment still names deploy.runner_user, not root, so a missing depriv drop-in cannot run job code as root.
• Permit-scope cutover is not in this PR: the fragment still renders BorrowerHeldCooperativeHostFifo. Stacked on Fleet permit-scope observer over the one systemctl-show transport #11279.

Test plan

• Floor includes test.claim.runner_unit_file_witness_test and test.claim.runner_host_file_converge_witness_test
• Desired population for srv1 is four /etc paths; srv9 refuses
• Depriv docker host is not the 1001 posix-row socket
• Fragment for srv3 pins srv3 and still has User=briansrls

Made with Cursor

[gunbai-bot]

Superseded by the dashboard-attached PR #11307 (same head). Closing this duplicate so 11307 can stack on #11279.