ci: stop a job whose sandbox leaks, first thing

Installing the runner on sahaquiel, `useradd --system` gave `runner` user ID 999: the ID
under which PostgreSQL and the server run inside their containers, which Docker doesn't
remap. To the kernel, those processes were the runner's own, so a job could have read the
server's environment (database password, session pepper, GitHub secret) and, through
/proc, PostgreSQL's files and its local socket, which the official image trusts. The
sandbox's other walls don't help there: ProtectProc hides only other users' processes,
IPAddressDeny doesn't cover Unix sockets. Only our own check ran as 999; `runner` now has
user and group ID 61000.

The check job now starts with a Sandbox step that fails unless only the runner's own
processes are visible, all in one process namespace, /home/deploy is invisible, the
Docker socket is unusable and Docker's bridge network unreachable. It would have caught
this; outside a sandbox it fails as it should. The unit and AGENTS.md say how to create
the user.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

.forgejo/workflows/ci.yaml

@@ -19,6 +19,28 @@ jobs:
       # The Flutter the app is developed with; move it together with the local one.
       FLUTTER_VERSION: 3.47.5
     steps:
+      # Before anything else runs, the job proves it can neither see nor reach production
+      # (the runner's sandbox, deploy/runner/). If it can, nothing else should run.
+      - name: Sandbox
+        run: |
+          fail() { echo "The runner's sandbox leaks: $*" >&2; exit 1; }
+          # Only the runner's own processes are visible. A container's process shows up
+          # (in a process namespace of its own) if it runs under the runner's user ID,
+          # and then its environment and files are readable too.
+          [ "$(ps -e -o uid= | sort -u | wc -l)" -eq 1 ] || fail "other users' processes are visible"
+          namespaces=$(for p in /proc/[0-9]*; do readlink "$p/ns/pid"; done 2>/dev/null | sort -u | wc -l)
+          [ "$namespaces" -le 1 ] || fail "processes of $namespaces process namespaces are visible"
+          # deploy's home (.env, the checkout, the dumps) and the Docker socket are out of
+          # reach.
+          [ ! -e /home/deploy ] || fail "/home/deploy is visible"
+          { [ ! -r /run/docker.sock ] && [ ! -w /run/docker.sock ]; } || fail "the Docker socket is usable"
+          # Docker's networks, where the database listens, are unreachable. Caddy listens on
+          # every address of the host, the Docker bridge's included.
+          if timeout 5 bash -c 'exec 3<>/dev/tcp/172.17.0.1/443' 2>/dev/null; then
+            fail "Docker's network is reachable"
+          fi
+          echo "This job can neither see nor reach production."
+
       - name: Check out
         env:
           TOKEN: ${{ github.token }}