fix(tools): run the publish guard as the committing user, not ci-runner

Documented with `sudo -u ci-runner`, copied from the neighbouring tools that
call the Gitea API. Wrong here: the guard fetches, fetching writes
.git/FETCH_HEAD, and that file belongs to the committing user -- so as
ci-runner it died with "impossibile aprire '.git/FETCH_HEAD': Permesso negato"
before comparing anything.

A guard that cannot run is worse than no guard, since the failure looks like
infrastructure noise rather than an answer. The question it asks is "does what
I have match what is published", so it belongs to whoever holds the working
tree.

plans/cargo-dependency-cache.md

@@ -1154,7 +1154,7 @@ Windows runner or by reading the branch — but record which you did.
 git add .gitea/actions/local-ci-build/action.yml
 git commit -m "feat(action): cargo-cache input, cold on release tags"
 git push origin main
-sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+/opt/ci/venv/bin/python tools/ci-action-published.py
 ```
 
 Expected: `OK — .gitea/ matches origin/main`. Committing is not deploying for
@@ -1357,7 +1357,7 @@ is available as a per-workflow override.
 git add plans/cargo-dependency-cache-measurements.md docs/RUNBOOK-PhaseC.md TODO.md
 git commit -m "docs(cache): end-to-end numbers for the cargo dependency cache"
 git push origin main
-sudo -u ci-runner /opt/ci/venv/bin/python tools/ci-action-published.py
+/opt/ci/venv/bin/python tools/ci-action-published.py
 ```
 
 ---