fix: let the update helper write the status volume owned by the app user [CI SKIP]

The status helper runs as root with all capabilities dropped, so it could not write a volume owned by uid 1654 (mktemp: Permission denied) and the volume updater failed on rootful Podman. Add DAC_OVERRIDE only.

packaging/update/moshiro-update.sh

@@ -101,7 +101,8 @@ write_status() { # state available_json error
   printf '{"state":"%s","current":"%s","available":%s,"error":"%s","at":%s}\n' \
     "$1" "$(current_digest)" "${2:-null}" "$(printf '%s' "${3:-}" | tr -d '"\\\n' | cut -c1-200)" "$(now)" > "$tmp"
   if [ -n "$DATA_VOLUME" ]; then
-    "$ENGINE" run --pull=never --rm -i --user 0 --network none --read-only --cap-drop ALL --security-opt no-new-privileges \
+    # 状态卷的属主可能是容器里的 app（1654）；root 丢掉全部能力后写不进去，所以只加回 DAC_OVERRIDE
+    "$ENGINE" run --pull=never --rm -i --user 0 --network none --read-only --cap-drop ALL --cap-add DAC_OVERRIDE --security-opt no-new-privileges \
       -v "$STATUS_VOLUME:/status" --entrypoint /bin/sh "$HELPER_IMAGE" \
       -c 'tmp=$(mktemp /status/.status.XXXXXX); cat > "$tmp"; chmod 644 "$tmp"; mv -f "$tmp" /status/status.json' < "$tmp"
   else