ops: fix deployment temp permissions

.github/ops/deploy-runner-fleet.sh

@@ -32,8 +32,8 @@ sudo -n -u nomad -H gh repo clone \
   "$fleet_repo" -- --branch feat/hosted-minute-repo-runners --single-branch --quiet
 
 sudo -n -u nomad -H bash -c 'cd "$1" && ./scripts/validate-repo.sh' bash "$fleet_repo"
-python3 -m py_compile "$scheduler_repo/tools/ci/ghrunnerd.py"
-bash -n "$light_repo/tools/ci/install-prisma-runner.sh"
+sudo -n -u nomad -H python3 -m py_compile "$scheduler_repo/tools/ci/ghrunnerd.py"
+sudo -n -u nomad -H bash -n "$light_repo/tools/ci/install-prisma-runner.sh"
 
 echo "== deploy PluginEditTool #194 scheduler fix =="
 sudo install -m 0755 \
@@ -47,7 +47,7 @@ echo "== fetch and verify pinned Actions runner =="
 sudo -n -u nomad -H curl -fL --retry 3 --retry-delay 2 \
   -o "$tarball" \
   https://github.com/actions/runner/releases/download/v2.336.0/actions-runner-linux-x64-2.336.0.tar.gz
-actual="$(sha256sum "$tarball" | awk '{print $1}')"
+actual="$(sudo -n -u nomad -H sha256sum "$tarball" | awk '{print $1}')"
 expected="04cf0be1aff4c3ec3554466c39124ca250e3effd8873bb7e8d68535aa9505d5d"
 test "$actual" = "$expected" || {
   echo "runner archive digest mismatch" >&2