fix: UI sidecar containers need --user 0:0 and CHOWN caps for rootless podman

The backend's post-install hooks create archy-bitcoin-ui, archy-lnd-ui,
archy-electrs-ui containers but with only NET_BIND_SERVICE cap. Nginx
inside these containers crashes on chown in rootless podman.

Added --user=0:0, CHOWN, DAC_OVERRIDE, SETUID, SETGID caps to match
the first-boot-containers.sh pattern. Also fixed manifest publish
Python error (git log fails in rsync'd workspace with no .git).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

core/archipelago/src/api/rpc/package/install.rs

@@ -872,15 +872,22 @@ autopilot.active=false\n",
                 };
 
                 // Run with --network=host (UIs proxy to localhost backend/bitcoin)
+                // --user 0:0: run as root inside container (still unprivileged on host
+                // in rootless podman) to avoid nginx chown failures
                 let run = tokio::process::Command::new("podman")
                     .args([
                         "run", "-d",
                         "--name", &name,
                         "--restart=unless-stopped",
                         "--network=host",
+                        "--user=0:0",
                         "--cap-drop=ALL",
+                        "--cap-add=CHOWN",
+                        "--cap-add=DAC_OVERRIDE",
                         "--cap-add=NET_BIND_SERVICE",
-                        "--memory=64m",
+                        "--cap-add=SETUID",
+                        "--cap-add=SETGID",
+                        "--memory=128m",
                         &image,
                     ])
                     .output()