Release image upload: the image directory belongs to the deploy user

The image job built as root and uploaded as the deploy user, so
publish-image.sh could not write SHA256SUMS (v0.3.0's image job failed).
The job hands the directory over after the build, and publish-image.sh
checks the SHA256SUMS build-image.sh wrote instead of rewriting it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -97,6 +97,7 @@ jobs:
           ssh "$USER@$HOST" "sudo rm -rf $W && mkdir -p $W/src"
           scp -q -r agent deploy/publish-image.sh "$USER@$HOST:$W/src/"
           ssh "$USER@$HOST" "sudo env AUTHKEYS= BUILD=$W/build OUT=$W/image bash $W/src/agent/build-image.sh > $W/build.log 2>&1 || { tail -40 $W/build.log; exit 1; }; tail -5 $W/build.log"
+          ssh "$USER@$HOST" "sudo chown -R \$(id -u):\$(id -g) $W/image" # the upload runs as the deploy user
           # refuse an image that lets someone in (a listing that fails refuses too)
           ssh "$USER@$HOST" "sudo unsquashfs -l $W/image/filesystem.squashfs > $W/files" ||
             { echo "::error::cannot list the image" >&2; exit 1; }

deploy/publish-image.sh

@@ -11,7 +11,8 @@ IMG=${IMG:-/srv/rollcall/image}
 HDR=$(mktemp); trap 'rm -f "$HDR"' EXIT
 printf 'Authorization: token %s\n' "$GITEA_TOKEN" > "$HDR" # not on curl's command line (ps)
 cd "$IMG"
-sha256sum vmlinuz initrd.img filesystem.squashfs > SHA256SUMS
+# build-image.sh writes SHA256SUMS; check it, or make it for an image without one
+if [ -f SHA256SUMS ]; then sha256sum -c --quiet SHA256SUMS; else sha256sum vmlinuz initrd.img filesystem.squashfs > SHA256SUMS; fi
 id=$(curl -fsS -H "@$HDR" "$API/releases/tags/$TAG" | python3 -c 'import json,sys;print(json.load(sys.stdin)["id"])')
 existing=$(curl -fsS -H "@$HDR" "$API/releases/$id/assets" | python3 -c 'import json,sys;[print(a["id"],a["name"]) for a in json.load(sys.stdin)]')
 for f in vmlinuz initrd.img filesystem.squashfs SHA256SUMS; do