ci(buildkite): run the Linux suite unprivileged

Build 1443 gave the first real numbers, and they are good: macOS workspace
tests 328s and Linux fmt+clippy 159s on hosted agents, against 56 minutes and
11 minutes for the same work on GitHub Actions. Linux tests failed, but not
for a product reason.

Hosted Linux agents run the job as root; GitHub's ubuntu runner uses the
unprivileged `runner` user. Root ignores permission bits, so every test that
makes a path read-only and asserts the write is refused instead succeeds at
writing and fails its assertion. Exactly four failed that way:

  launch::tests::an_unwritable_home_reports_the_failure_and_still_answers
  tools::file::pdf_tests::contract_edit_rejects_read_only_target_before_atomic_replace
  config_bundles::tests::failed_apply_rolls_back_to_the_prior_document
  fleet::executor::tests::executor_runs_real_process_and_drains_stream_json_into_ledger_events

`launch.rs:331` is explicit about the contract it is checking -- "an unwritable
home must be reported, not swallowed" -- which root cannot violate.

Drop to an unprivileged user for the suite rather than skipping those cases or
allowing them to fail. They guard data-loss and permission behaviour; a lane
that structurally cannot exercise them is a weaker gate that still reports
green, which is the failure mode this whole pipeline change exists to remove.
common.sh now exports CARGO_HOME/RUSTUP_HOME explicitly so the toolchain
survives the user swap.

Signed-off-by: CodeWhale Bot <bot@codewhale.net>

.buildkite/steps/common.sh

@@ -25,5 +25,11 @@ fi
 # shellcheck disable=SC1091
 [ -f "$HOME/.cargo/env" ] && . "$HOME/.cargo/env"
 
+# Export toolchain homes explicitly so the unprivileged re-exec in test.sh can
+# inherit them; rustup's default HOME-relative paths do not survive a user swap.
+export CARGO_HOME="${CARGO_HOME:-$HOME/.cargo}"
+export RUSTUP_HOME="${RUSTUP_HOME:-$HOME/.rustup}"
+export PATH="$CARGO_HOME/bin:$PATH"
+
 cargo --version
 rustc --version

.buildkite/steps/test.sh

@@ -10,8 +10,41 @@ if ! command -v cargo-nextest >/dev/null 2>&1; then
   cargo install cargo-nextest --locked --version 0.9.* || cargo install cargo-nextest --locked
 fi
 
-echo "--- workspace tests"
-cargo nextest run --workspace --all-features --locked --profile ci
+# Hosted Linux agents run the job as root. That is not equivalent to GitHub's
+# `runner` user: root ignores permission bits, so every test that makes a path
+# read-only and asserts the write is refused instead *succeeds* at writing and
+# fails the assertion. Build 1443 failed exactly four tests this way --
+# an_unwritable_home_reports_the_failure_and_still_answers,
+# contract_edit_rejects_read_only_target_before_atomic_replace,
+# failed_apply_rolls_back_to_the_prior_document, and one fleet executor case --
+# none of which are product defects.
+#
+# Drop to an unprivileged user rather than skipping them: those tests guard
+# data-loss and permission behaviour, and a CI lane that silently cannot
+# exercise them is a weaker gate reporting green.
+run_suite() {
+  echo "--- workspace tests"
+  cargo nextest run --workspace --all-features --locked --profile ci
+  echo "--- doctests"
+  cargo test --workspace --all-features --locked --doc
+}
 
-echo "--- doctests"
-cargo test --workspace --all-features --locked --doc
+if [ "$(id -u)" = "0" ] && [ "$(uname -s)" = "Linux" ]; then
+  id -u builder >/dev/null 2>&1 || useradd -m -s /bin/bash builder
+  chown -R builder:builder . "$CARGO_HOME" "$RUSTUP_HOME" 2>/dev/null || true
+  echo "--- re-exec as unprivileged user (root ignores permission bits)"
+  exec runuser -u builder -- env \
+    PATH="$PATH" CARGO_HOME="$CARGO_HOME" RUSTUP_HOME="$RUSTUP_HOME" \
+    CARGO_TERM_COLOR="${CARGO_TERM_COLOR:-always}" \
+    CARGO_INCREMENTAL="${CARGO_INCREMENTAL:-0}" \
+    RUST_MIN_STACK="${RUST_MIN_STACK:-16777216}" \
+    bash -eo pipefail -c '
+      cd "$1"
+      echo "--- workspace tests (uid $(id -u))"
+      cargo nextest run --workspace --all-features --locked --profile ci
+      echo "--- doctests"
+      cargo test --workspace --all-features --locked --doc
+    ' _ "$PWD"
+fi
+
+run_suite