fix: add USER root to Hummingbird builder stages for dnf access

[maxamillion]

Summary

• Fixes container image build failures caused by Hummingbird builder images defaulting to non-root UID 65532.

Problem

All Hummingbird :latest-builder images run as non-root by default (UID 65532). The dnf install commands and writes to system directories (/etc/yum.repos.d/) fail with "Permission denied" or "requires superuser privileges".

Fix

Adds USER root immediately after the FROM directive in every stage that runs privileged operations:

File	Stages
deploy/docker/Dockerfile.images	rust-builder-base, nvidia-container-toolkit, cluster
deploy/docker/Dockerfile.ci	Main stage
examples/bring-your-own-container/Dockerfile	Main stage

The gateway image (core-runtime:latest-openssl) is unaffected — it's distroless and doesn't run dnf.

Testing

After merging, trigger the container builds:

gh workflow run "Midstream Container Build" --repo LobsterTrap/OpenShell --ref midstream
gh workflow run "Build CI Image" --repo LobsterTrap/OpenShell --ref midstream

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: a8c8dde0-3671-4788-83bf-24b343c74ade

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}