ci: run container jobs as root for checkout@v6 EACCES fix

coq-kernel, coq-proofs, rings-rust container blocks get options: --user root
so actions/checkout@v6 (Node 24) can write _temp save_state files.

Closes #1031

Author: gHashTag

.github/workflows/coq-kernel.yml

@@ -15,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
+      options: --user root
     steps:
       - uses: actions/checkout@v6
 

.github/workflows/coq-proofs.yml

@@ -15,6 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: coqorg/coq:8.19-ocaml-4.14-flambda
+      options: --user root
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6

.github/workflows/rings-rust.yml

@@ -59,6 +59,7 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: rust:1.83-bookworm
+      options: --user root
     continue-on-error: true
     strategy:
       fail-fast: false

docs/NOW.md

@@ -2,6 +2,12 @@
 
 Last updated: 2026-06-14
 
+## ci-checkout6-container-root -- fix checkout@v6 EACCES inside container jobs (Closes #1031)
+
+- **WHERE** (CI only): `.github/workflows/coq-kernel.yml`, `.github/workflows/coq-proofs.yml`, `.github/workflows/rings-rust.yml`. Added `options: --user root` to each `container:` block. `actions/checkout@v6` runs on Node 24; inside container jobs the runner-injected `_temp/_runner_file_commands/save_state_*` files are root-owned but the action ran as a non-root container user, so the Post-checkout `save_state` failed with `EACCES: permission denied`, failing the job. Running the container as root lets the action write those state files. `vivado-synth.yml` already had `options: --user 0`; `build-vivado-image.yml` has no real container job. No source/specs/codegen/conformance/`gen/` touched.
+- **Why**: completes the actions/checkout 4->6 bump (#1044). Required gates unaffected; container build/proof jobs (coq, rings-rust) no longer fail on the EACCES Post step. Human PRs remain fully gated. L6/L5 untouched; L4 not applicable (workflow YAML). Closes #1031.
+- **Anchor**: phi^2 + phi^-2 = 3
+
 ## ci-fix-bypass-echo -- fix no-op bypass step shell parse error (Closes #1031)
 
 - **WHERE** (CI only): `.github/workflows/l1-traceability.yml`, `.github/workflows/issue-gate.yml`, `.github/workflows/now-sync-gate.yml`. The trusted-bot no-op step used an inline `run: echo "... (Closes #1031)."`; the `#` opened a YAML/shell comment that truncated the command and the unbalanced parenthesis made the shell exit 2, so the gate job concluded `failure` for bots even though IS_BOT was correctly true and all substantive steps skipped. Switched to a block scalar (`run: |`) with a plain ASCII echo (no `#`, no parentheses). No source/specs/codegen/conformance/`gen/` touched.