fix: make admin wrapper fixture portable in CI

package.json

@@ -1,6 +1,6 @@
 {
   "name": "tallynote",
-  "version": "1.1.15",
+  "version": "1.1.17",
   "private": true,
   "type": "module",
   "packageManager": "pnpm@9.0.6",

scripts/test-installer.sh

@@ -88,6 +88,12 @@ bash -c '
   chmod 700 "$mode_dir"
   [[ "$(stat_mode_bits "$mode_dir")" == 448 ]]
   mkdir -p "$owner_parent"
+  # CI runs this shell suite as root. Make the parent genuinely non-root in
+  # that environment so the assertion exercises the ownership guard instead
+  # of accidentally passing because root-owned parents are allowed.
+  if [[ "${EUID:-$(id -u)}" == 0 ]]; then
+    chown 65534:65534 "$owner_parent"
+  fi
   if (assert_path_chain "$owner_parent/child") >/dev/null 2>&1; then
     echo "expected non-root path parent to fail" >&2
     exit 1
@@ -247,7 +253,11 @@ ln -s "$wrapper_prefix/releases/1.0.0" "$wrapper_prefix/current"
 printf '%s\n' '#!/usr/bin/env bash' 'pwd -P > "$TALLYNOTE_WRAPPER_LOG"' 'printf "%s\n" "$@" >> "$TALLYNOTE_WRAPPER_LOG"' > "$wrapper_prefix/releases/1.0.0/runtime/bin/node"
 chmod 755 "$wrapper_prefix/releases/1.0.0/runtime/bin/node"
 printf '%s\n' cli > "$wrapper_prefix/releases/1.0.0/dist/server/cli/admin-init.js"
-TALLYNOTE_INSTALL_PREFIX="$wrapper_prefix" TALLYNOTE_CONFIG_DIR="$tmp/no-config" TALLYNOTE_WRAPPER_LOG="$tmp/wrapper.log" \
+# This fixture verifies release-relative execution and argument forwarding.
+# Force the wrapper's non-root branch so the root CI runner does not need a
+# real `tallynote` service account or a privileged runuser hand-off; that
+# privilege boundary is validated by the production checks themselves.
+env EUID=1000 TALLYNOTE_INSTALL_PREFIX="$wrapper_prefix" TALLYNOTE_CONFIG_DIR="$tmp/no-config" TALLYNOTE_WRAPPER_LOG="$tmp/wrapper.log" \
   bash "$root/bin/tallynote-admin-init" --generate
 wrapper_expected_root=$(cd "$wrapper_prefix/releases/1.0.0" && pwd -P)
 grep -Fxq "$wrapper_expected_root" "$tmp/wrapper.log"