fix(demo): chown modules/ and logs/ from a root container in the wipe

The runner user is not root, so the host chown failed and `|| true` hid it.
The app (uid 1000) then could not unpack the declared module into ./modules,
came up healthy with no module, and seed:demo refused the fixture's
rust.command.run event (website run 358, the first scheduled wipe).

A throwaway container runs as root and the runner is in the docker group, so
the chown now happens there, and a failure stops the run at that step.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

.gitea/workflows/demo-wipe.yml

@@ -59,7 +59,10 @@ jobs:
           test -f "$DEMO_DIR/.env" || { echo "::error::$DEMO_DIR/.env is missing; see deploy/demo/README.md"; exit 1; }
           mkdir -p "$DEMO_DIR/state" "$DEMO_DIR/logs" "$DEMO_DIR/modules"
           # The app runs as uid 1000 and unpacks the declared module into ./modules.
-          chown 1000:1000 "$DEMO_DIR/modules" "$DEMO_DIR/logs" 2>/dev/null || true
+          # The runner is not root, so a host chown fails; a container is root and
+          # the runner may start one. A failure here stops the run: without it the
+          # app comes up healthy with no module and the seed fails much later.
+          docker run --rm -v "$DEMO_DIR:/demo" "$NODE_IMAGE" chown -R 1000:1000 /demo/modules /demo/logs
           cp deploy/demo/docker-compose.yml deploy/demo/seed.json deploy/demo/rig.mjs "$DEMO_DIR/"
 
       - name: Decide the versions