fix: deployment corrections from independent review

Six fixes addressing operational correctness on a real Debian host:

1. Ownership after git operations: chown -R zopu:zopu on the checkout
   after clone/update/rollback before running bun install/build as the
   service user. .env kept at 0600 with explicit chmod after each
   operation.

2. sudo replaced with runuser: minimal Debian does not include sudo.
   runuser is part of util-linux (essential) and always available.
   All three scripts (bootstrap, update, rollback) now use runuser -u.

3. cron.d entry fixed: /etc/cron.d format requires a username field.
   Added ${SERVICE_USER} between the time fields and the command path.

4. Firewall: added explicit `ufw allow in on tailscale0` rule so the
   deny-incoming default does not block Tailscale private-overlay
   reachability. Removed inaccurate claim that direct private IP works
   by default; documented that an explicit per-interface rule is needed.

5. SupplementaryGroups=docker added to zopu-agent.service: the Orb
   sandbox runtime lives in the agent process, not just the daemon.

6. zopu-health.service: added Environment=ENV_FILE=__INSTALL_DIR__/.env
   so health-check.sh sources the correct .env at custom install paths.

Verified Flue build output: bun run build:agents produces
packages/agents/dist/server.mjs (confirmed by running the build).
Agent unit ExecStart path is correct.

Validated: bash -n on all 6 shell scripts; mocked health-check smoke
against live RivetKit engine on port 6420; systemd unit structural
checks. No JS/TS/agent files changed.

deploy/zopu-runtime/README.md

@@ -33,7 +33,7 @@ service, Docker Engine for future Orb sandboxes, and supporting infrastructure.
 │                                                               │
 │  systemd timers: health-check (60s), docker-cleanup (daily)  │
 │  cron: disk-monitor (daily 06:00)                             │
-│  ufw: deny-by-default, SSH only                              │
+│  ufw: deny-incoming, SSH + tailscale0                              │
 │  Tailscale: optional private overlay                          │
 └─────────────────────────────────────────────────────────────┘
 ```
@@ -265,16 +265,25 @@ Default alert threshold is 80%.
 ## Firewall and private networking
 
 The firewall (`ufw`) is deny-by-default:
-- SSH (port 22) is allowed
+- SSH (port 22) is allowed on all interfaces
+- All traffic on `tailscale0` is allowed (Tailscale private overlay)
 - All other incoming traffic is denied
 
 The RivetKit engine (`:6420`) and Flue agent (`:3583`) ports are **not**
-exposed publicly. Access is via:
+exposed on public interfaces. Reachability options:
 
-1. **Tailscale** (recommended): private overlay network. Set
+1. **Tailscale** (recommended): bootstrap runs `ufw allow in on tailscale0`
+   so all ports are reachable over the private overlay. Set
    `TAILSCALE_AUTHKEY` before running bootstrap to configure automatically.
-2. **Direct private IP**: if the server is on a private network, the ports
-   are reachable from other machines on the same subnet.
+   Other Tailscale-connected machines can reach the agent at
+   `http://zopu-runtime:3583` and the engine at `http://zopu-runtime:6420`.
+2. **Custom private interface**: if you have a non-Tailscale private network
+   (e.g. a VLAN or wireguard interface), add an explicit rule:
+   ```bash
+   ufw allow in on eth1  # or your private interface name
+   ```
+   Do NOT assume direct private IP access works by default — the deny-incoming
+   policy blocks it until an interface-specific rule is added.
 3. **Caddy** (optional): install Caddy and use the annotated Caddyfile in
    `caddy/` if you need TLS termination or a public ingress point.