fix(ci): add non-root user to test Containerfile

[marcusburghardt]

Summary

Trivy source scan flags DS-0002 (Image user should not be root) on the test
Containerfile used by ci_test_publish_ghcr. This was introduced in #285.

Adds USER nobody to satisfy the misconfig check.

Related Issues

• Identified when working on refactor(ci): extract trivy image scan into separate reusable workflow #290 (Trivy source scan fails on PR CI)

Review Hints

• Single-line addition (USER nobody) to a test-only Containerfile. The image only runs cat /test-marker which does not require root.

[marcusburghardt]

CI note: The Test Attestations Override and Test Unprotected Ref failures are unrelated to this Containerfile change. They fail on fork PRs because the GITHUB_TOKEN has read-only packages permission, so the test cannot push images to GHCR. The org membership check also fails for members with private visibility (see the -L redirect to /public_members in reusable_publish_ghcr.yml:133-138). These checks can be waived for this PR.

@trevor-vaughan -- to avoid these recurring failures on fork PRs while preserving the intent of these test workflows, would it make sense to gate them with a fork detection condition? For example:

if: >-
  needs.check-changes.outputs.ghcr_files_changed == 'true' &&
  github.event.pull_request.head.repo.full_name == github.repository

This would cleanly skip the publish tests on fork PRs (where they can never succeed due to token restrictions) while keeping them running for internal PRs.

[trevor-vaughan]

@marcusburghardt Good call on the fork check. Do you want to add that to this PR?

[marcusburghardt]

@marcusburghardt Good call on the fork check. Do you want to add that to this PR?

Sure. It should be a couple of lines, but would like to get your thoughts before. :) Let me do that in a minute.

[trevor-vaughan]

Change makes sense. Sorry for not thinking about that earlier!

[marcusburghardt]

Change makes sense. Sorry for not thinking about that earlier!

No worries. I also didn't "see" this during review. : )