dietpi-software: replace runuser with setpriv

[MichaIng]

• runuser preserves the environment, and has no option to reset it without initializing a login shell (which fails for nologin users).

  This solves e.g. the issue that runuser -u user -- uv python install prefers XDG_DATA_HOME over the user's home dir as Python install target. It makes sense from security aspect, too, and setpriv performs faster than runuser, as it skips the PAM session. Call env explicitly to pass specific variables, and --clear-groups by default, or --init-groups if we know that we require a supplemental group, like redis for Nextcloud occ calls.

• Additionally, this fixes obtaining Synapse dependencies, and updates lxml and pillow dependencies, now available for Python 3.13 on piwheels.

• Disable mjpg-streamer for Forky, due to incompatibility with its cmake.

• Replace /bin/touch to trigger x-systemd.automount for EnvironmentFile in systemd units with /bin/test -e. The service user does not always have write permissions, and we do not want to bump the mtime of the file anyway.

• Add ProtectProc=, NoExecPaths=, and ExecPaths= to workaround for systemd sandboxing with QEMU on Forky.

• Allow setuid/setgid bits to function inside the container, required for recent Koel to add its cron job.

• /sbin and /bin are removed from PATH where we set it. All our images are usr-merged, enforeced by Debian since Bookworm.

Test installs: https://github.com/MichaIng/DietPi/actions/runs/25060637144

[Copilot]

Pull request overview

This PR modernizes DietPi-Software’s privilege dropping to ensure a clean environment when executing commands as service users, addressing install/runtime issues caused by inherited environment variables (notably with uv). It also includes a few targeted fixes for dependency handling and CI/container behavior.

Changes:

• Replace runuser usages with setpriv ... --reset-env (and --init-groups where supplemental groups are required).
• Adjust Python dependency handling (Synapse deps fix; update lxml/pillow/piwheels-related logic) and a few install-time command tweaks.
• Update CI container/emulation handling (binfmt changes for setuid/setgid behavior; additional systemd sandboxing overrides), plus related unit tweaks (touch → test -e).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
dietpi/dietpi-software	Switch command execution to setpriv --reset-env, fix some Python deps handling, and adjust several install/unit snippets accordingly.
CHANGELOG.txt	Document the runuser→setpriv change and a couple of related DietPi-Software fixes.
.github/workflows/dietpi-software.bash	Update CI emulation/container setup to support setuid/setgid under QEMU and relax/override additional systemd sandboxing knobs.