fix: give uid 1000 a passwd entry, so ssh-keygen runs as the runner user (#18)

With openssh-keygen in the image (#17, 12.11.1-ci11), zegit's SSHSIG
oracle test still failed on this runner: `ssh-keygen -Y verify` answered
"No user exists for uid 1000" (exit 255). The pod runs as uid 1000, which
has no /etc/passwd entry here, and ssh-keygen looks the current user up
(zegit#575, Gitea run 25467 job 56050).

The image adds a `runner` user and group for uid/gid 1000 (when the base
has none) with a home directory, and a build step running as uid 1000
signs and verifies an SSHSIG, so a missing entry fails the build.

Checked on the operator workstation: zegit's test fails in ci11 run as
--user 1000 ("No user exists for uid 1000") and passes in this build.

Refs: zegit-zoo/zegit#575
Co-Authored-By: Claude Opus 5.5 <[email protected]>

Dockerfile

@@ -86,6 +86,10 @@ USER root
 #             anywhere. chromedp finds `chromium`/`chromium-browser` on PATH;
 #             chrome-launcher honours CHROME_PATH. font-noto so text renders
 #             (an empty font set makes layout/contrast audits meaningless).
+# openssh-keygen -> `ssh-keygen`: zegit's SSHSIG oracle test
+#             (TestSSHSIG_ChecksumsVerifyWithSSHKeygen_441) verifies release-checksum
+#             signatures with `ssh-keygen -Y verify` and fails under CI without it,
+#             so the v0.1.56 cut was refused on this runner (zegit#575).
 # postgresql-client -> `psql`, so the lighthouse job can CREATE/DROP its own
 #             database on the runner's ci-postgres (ZEGIT_TESTPG_DSN) instead
 #             of migrating the shared maintenance database from under the
@@ -111,7 +115,18 @@ RUN apk add --no-cache \
       jq \
       chromium \
       font-noto \
-      postgresql-client
+      postgresql-client \
+      openssh-keygen
+
+# ssh-keygen signs and verifies an SSHSIG in namespace "file", the form zegit's
+# test uses, so a build without a working ssh-keygen fails here, not in CI.
+RUN set -eu; d=$(mktemp -d); \
+    ssh-keygen -q -t ed25519 -N '' -f "$d/k"; \
+    echo smoke > "$d/f"; \
+    ssh-keygen -q -Y sign -n file -f "$d/k" "$d/f"; \
+    printf 'smoke %s\n' "$(cat "$d/k.pub")" > "$d/allowed"; \
+    ssh-keygen -Y verify -f "$d/allowed" -I smoke -n file -s "$d/f.sig" < "$d/f"; \
+    rm -rf "$d"
 
 # CVE-2026-111497 (brotli decoder out-of-bounds write, CISA KEV, due 2026-11-10): the
 # forgejo/runner:12.11.1 base ships brotli-libs 1.2.0-r0, and `apk add` above never
@@ -128,5 +143,23 @@ RUN set -eux; \
 # The patched binary replaces the stock one (see the runner-build stage).
 COPY --from=runner-build /out/forgejo-runner /bin/forgejo-runner
 
+# A passwd entry for uid 1000, the runner pod's runAsUser. Tools that look up
+# the current user (getpwuid) refuse without one: ssh-keygen -Y verify answered
+# "No user exists for uid 1000" (exit 255) once openssh-keygen was in the image,
+# so zegit's SSHSIG oracle test still failed on this runner (zegit#575).
+RUN grep -q ':x:1000:' /etc/passwd || echo 'runner:x:1000:1000:runner:/home/runner:/bin/sh' >> /etc/passwd; \
+    grep -q ':x:1000:' /etc/group || echo 'runner:x:1000:' >> /etc/group; \
+    mkdir -p /home/runner && chown 1000:1000 /home/runner
+
 # Match the runner pod's runAsUser (1000); keep the image non-root by default.
 USER 1000
+
+# As that user, ssh-keygen signs and verifies an SSHSIG, so a missing passwd
+# entry fails the build here, not in CI.
+RUN set -eu; d=$(mktemp -d); \
+    ssh-keygen -q -t ed25519 -N '' -f "$d/k"; \
+    echo smoke > "$d/f"; \
+    ssh-keygen -q -Y sign -n file -f "$d/k" "$d/f"; \
+    printf 'smoke %s\n' "$(cat "$d/k.pub")" > "$d/allowed"; \
+    ssh-keygen -Y verify -f "$d/allowed" -I smoke -n file -s "$d/f.sig" < "$d/f"; \
+    rm -rf "$d"