Decide a single account layout for GARM runners and drop the .env USER/LOGNAME override #438

The runner images create runner as a duplicate-UID alias of ubuntu (same uid 1000, gid 1000, home /home/ubuntu, /home/runner -> /home/ubuntu), because the legacy manager runs as ubuntu (su - ubuntu) and GARM runs as runner.

That makes uid -> name non-injective: getpwuid(1000) returns ubuntu, so $USER (runner) disagrees with every UID-keyed lookup. canonical/toolchains-ci fails on every GARM pool at:

sudo usermod -aG sbuild $USER   # writes "runner" into /etc/group
sg sbuild -c 'mk-sbuild noble'  # looks up "ubuntu" -> password prompt
# Password: Invalid password.

#437 is a stopgap: it writes USER/LOGNAME = the account the runner UID resolves to into the runner .env, so $USER matches what sg, chown and id -un use. It does not remove the alias. A literal runner, a su - runner/sudo -u runner hop, or anything outside the job environment still sees the split, and group membership is recorded under ubuntu while GARM's account stays runner.

Options

All three are image-side and need no upstream change except C:

• A. One name per UID. Drop ubuntu, keep runner with home /home/ubuntu. No permission work at all. Breaks su - ubuntu, so it needs the legacy OpenStack pools retired first.
• B. Distinct UID and GID. runner gets uid 1001 / gid 1001 and joins ubuntu as a supplementary group; /home/ubuntu becomes 2770, umask 0002. Both managers keep working. Adds a permission contract: every 0600 file and 0700 directory in the home has to be re-decided, and any later chown -R ubuntu:ubuntu silently resets it.
• C. GARM runs as ubuntu. Needs defaults.DefaultUser to be configurable (upstream PR or a patch in the GARM rock). Then the alias, alias group, /home/runner symlink and --shell all go away, and PAMName=su-l, the /etc/environment PATH line and linger stay because they emulate su -, not the account.

Acceptance criteria

• getent passwd <uid> and getent group <gid> return exactly one entry on the runner images.
• usermod -aG <group> runner followed by sg <group> works with no environment override.
• The USER/LOGNAME .env override is removed from the charm, and the image/GARM layout that replaces it is documented.
• Image build fails if any uid or gid has more than one name.
• A per-pool contract job asserts $USER = id -un and the usermod + sg round trip.

Related: #437 (stopgap), canonical/toolchains-ci .github/workflows/dotnet-packages-daily.yml.