fix(tools): run the publish guard as the committing user, not ci-runner

Documented with `sudo -u ci-runner`, copied from the neighbouring tools that
call the Gitea API. Wrong here: the guard fetches, fetching writes
.git/FETCH_HEAD, and that file belongs to the committing user -- so as
ci-runner it died with "impossibile aprire '.git/FETCH_HEAD': Permesso negato"
before comparing anything.

A guard that cannot run is worse than no guard, since the failure looks like
infrastructure noise rather than an answer. The question it asks is "does what
I have match what is published", so it belongs to whoever holds the working
tree.

docs/RUNBOOK-PhaseC.md

@@ -621,11 +621,15 @@ while a downstream repo chased a snapshot-name bug that was fixed locally.
 Check before announcing any action change as done:
 
 ```bash
-sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+/opt/ci/venv/bin/python tools/ci-action-published.py
 # OK   — .gitea/ matches origin/main; CI runs what you see here.
 # FAIL — lists the drifted files, exit 1
 ```
 
+Run it as the user who commits, **not** under `sudo -u ci-runner`: it fetches,
+which needs write access to `.git`, and `.git/FETCH_HEAD` here belongs to the
+committing user.
+
 It catches both ways of being unpublished, committed-but-unpushed and
 edited-but-uncommitted, and fetches first so it compares against the server
 rather than a stale remote-tracking ref (`--no-fetch` to skip the network).

plans/cargo-dependency-cache.md

@@ -1154,7 +1154,7 @@ Windows runner or by reading the branch — but record which you did.
 git add .gitea/actions/local-ci-build/action.yml
 git commit -m "feat(action): cargo-cache input, cold on release tags"
 git push origin main
-sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+/opt/ci/venv/bin/python tools/ci-action-published.py
 ```
 
 Expected: `OK — .gitea/ matches origin/main`. Committing is not deploying for
@@ -1357,7 +1357,7 @@ is available as a per-workflow override.
 git add plans/cargo-dependency-cache-measurements.md docs/RUNBOOK-PhaseC.md TODO.md
 git commit -m "docs(cache): end-to-end numbers for the cargo dependency cache"
 git push origin main
-sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+/opt/ci/venv/bin/python tools/ci-action-published.py
 ```
 
 ---

tools/ci-action-published.py

@@ -11,8 +11,12 @@ That is not hypothetical: 59 commits sat unpushed for a day while a downstream
 repo debugged a snapshot-name bug we had already fixed locally (thread entry
 furyrs#14, 2026-07-22).
 
+Run it as the user who commits, not as ``ci-runner``: it fetches, which needs
+write access to ``.git``, and the question it answers is "does what I have
+match what is published".
+
 Usage:
-    sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+    /opt/ci/venv/bin/python tools/ci-action-published.py
     ... --ref main --no-fetch     # skip the network round-trip
 
 Exit 0 when the published `.gitea/` tree matches this working tree, 1 when it