fix: deployment corrections from independent review

Six fixes addressing operational correctness on a real Debian host:

1. Ownership after git operations: chown -R zopu:zopu on the checkout
   after clone/update/rollback before running bun install/build as the
   service user. .env kept at 0600 with explicit chmod after each
   operation.

2. sudo replaced with runuser: minimal Debian does not include sudo.
   runuser is part of util-linux (essential) and always available.
   All three scripts (bootstrap, update, rollback) now use runuser -u.

3. cron.d entry fixed: /etc/cron.d format requires a username field.
   Added ${SERVICE_USER} between the time fields and the command path.

4. Firewall: added explicit `ufw allow in on tailscale0` rule so the
   deny-incoming default does not block Tailscale private-overlay
   reachability. Removed inaccurate claim that direct private IP works
   by default; documented that an explicit per-interface rule is needed.

5. SupplementaryGroups=docker added to zopu-agent.service: the Orb
   sandbox runtime lives in the agent process, not just the daemon.

6. zopu-health.service: added Environment=ENV_FILE=__INSTALL_DIR__/.env
   so health-check.sh sources the correct .env at custom install paths.

Verified Flue build output: bun run build:agents produces
packages/agents/dist/server.mjs (confirmed by running the build).
Agent unit ExecStart path is correct.

Validated: bash -n on all 6 shell scripts; mocked health-check smoke
against live RivetKit engine on port 6420; systemd unit structural
checks. No JS/TS/agent files changed.

deploy/zopu-runtime/systemd/zopu-agent.service

@@ -32,5 +32,8 @@ ProtectSystem=full
 ProtectHome=true
 PrivateTmp=true
 
+# Docker socket access for Orb sandbox runtime (lives in agent process)
+SupplementaryGroups=docker
+
 [Install]
 WantedBy=multi-user.target

deploy/zopu-runtime/systemd/zopu-health.service

@@ -5,4 +5,7 @@ Description=Zopu Health Check
 Type=oneshot
 User=__SERVICE_USER__
 EnvironmentFile=__INSTALL_DIR__/.env
+# health-check.sh reads ENV_FILE to find the .env to source. Set it to the
+# install path so custom install dirs work correctly.
+Environment=ENV_FILE=__INSTALL_DIR__/.env
 ExecStart=__INSTALL_DIR__/deploy/zopu-runtime/scripts/health-check.sh --quiet