Reject unsafe unprivileged Linux ID overrides

[BrettKinny]

Summary

• reject native unprivileged Linux POSIX installs when effective PUID/PGID differs from the invoking account
• fail before checkout, private-config updates, Install identity publication, or runtime calls
• preserve matching genuine non-1000 accounts, root-run rootful NAS/Unraid remapping, Darwin, MINGW, and rootless Podman policy
• document stale recorded-ID adoption and narrowly guarded recovery

Closes #145
Blocks release qualification #126 until merged and requalified.

Validation

• all 17 executable repository test modules
• deterministic lifecycle matrix: UID-only mismatch, GID-only mismatch, matching non-1000 IDs, recorded mismatch, root-run Docker/rootful override, root-run rootless Podman rejection, Darwin, MINGW
• bash -n and git diff --check
• Docker build squarebox:puid-guard
• smoke E2E: 62/62
• real host probe: invoking 1000:1000, requested 4242:4243, exit 64, no install path created
• two independent review passes; all blockers resolved

Release

v1.2.1-rc4 remains NO-PROMOTE. After this merges, prepare v1.2.1-rc5 and repeat Candidate plus Linux qualification.