Give the kept-folder tests' folders an unprivileged owner when they run as root (hq ADR 0325)

The build seat runs merge-check as root, so every folder a test made was root's
data, which is never kept (§12), and 28 tests failed for that alone. A test's
folders now stand for an operator's: run as root, they are given to nobody before
they are judged. The root rule is unchanged.

cmd/mesh-host/kept_test.go

@@ -33,6 +33,14 @@ func TestAnAccessTheMeshMayNotKeepYetIsSaidAsAWaitOfItsOwnKind(t *testing.T) {
 	if err := os.MkdirAll(filepath.Join(lib, "a film"), 0o755); err != nil {
 		t.Fatal(err)
 	}
+	// Run as root (the build seat's merge-check), the test's folders stand for an operator's, never root's.
+	if os.Geteuid() == 0 {
+		for _, p := range []string{dir, lib, filepath.Join(lib, "a film")} {
+			if err := os.Lchown(p, 65534, 65534); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
 	v := judgeAccess(judgedAccess{module: "radarr", id: "radarr.movies", name: "movies", path: lib,
 		users: []store.KeptUser{{Identity: "mesh-radarr", UID: 61001, Use: "read-write", From: "container"}}})
 	if v.state != link.StateWaiting || len(v.waits) != 1 {