e2e: chown bind-mount dirs to UID 1042 before stack up

The previous run got past install-secrets and migrations but failed at
JWT keypair generation: container writes as `deploy` (UID 1042) per
the README's deploy-host UID/GID contract, but CI runners aren't an
operator's 1042-group host, so the bind-mounted ./jwt is owned by the
runner user and `chmod` semantics give EACCES.

`sudo chown -R 1042:1042 jwt media backup` after install-secrets and
before `task up`. Mirrors what an operator's `useradd -u 1042 deploy`
does on a Linux host — just at workflow scope rather than as a host
boot step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: turegjorup

.github/workflows/e2e.yaml

@@ -78,6 +78,15 @@ jobs:
       - name: install-secrets (would be `task install`'s first step)
         run: ./scripts/install-secrets.sh
 
+      - name: Pre-create bind-mount dirs with container-writable perms
+        # The os2display container writes JWT keys as UID 1042 (`deploy`)
+        # per README's deploy-host UID/GID contract, and uploads to
+        # ./media as the same user. CI runners aren't the operator's
+        # 1042-group host, so chown the bind-mount sources to match.
+        run: |
+          mkdir -p jwt media backup
+          sudo chown -R 1042:1042 jwt media backup
+
       - name: task up
         # `task up` uses `compose up -d --wait`, so this blocks until every
         # service's healthcheck passes. Migrations on the next step can