fix(makefile): create container files as the host user, not root

`docker exec` defaults to root, so `make install-plugins` wrote plugins into
the ./user bind mount as root — un-removable on the host without a root
container (exactly what blocked the 2.0.4 worktree cleanup). The grav service
can't simply run `user: 1000` because the base image entrypoint needs root to
bind :80 and set up cron, so drop only the file-CREATING CLI to the host user:

- HOST_UID/HOST_GID from id -u / id -g
- install-plugins makes cache/tmp writable (container-internal, never touches
  the host) then runs gpm as the host user, so plugins land owned by you — no
  post-hoc chown, no root files, no root rm needed at teardown

Verified: gpm reinstall as uid 1000 leaves 0 root-owned files under ./user
(was 11624), site healthy (/ and /admin 200), plugin patches reapplied.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RDS6t8wcpbwKvvrxykVQ5K

Makefile

@@ -79,6 +79,13 @@ GRAV_CONTAINER ?= intotheeast_grav
 GRAV_PORT      ?= 8081
 TM_PORT        ?= 8082
 
+# The container boots as root (the base image entrypoint needs it to bind :80
+# and set up cron), so a bare `docker exec` runs as root and any file it writes
+# into the ./user bind mount is root-owned on the host. Run the file-CREATING
+# CLI commands as the host user instead, so their output belongs to you.
+HOST_UID := $(shell id -u)
+HOST_GID := $(shell id -g)
+
 build:
 	docker compose build
 
@@ -108,7 +115,12 @@ fix-perms:
 
 
 install-plugins:
-	docker exec -w /var/www/html $(GRAV_CONTAINER) php bin/gpm install $(shell cat plugins.txt | tr '\n' ' ') -y
+	# cache/ and tmp/ are root-owned in the image, so make them writable first
+	# (container-internal chown — never touches the host) so gpm can run AS YOU.
+	docker exec $(GRAV_CONTAINER) chown -R $(HOST_UID):$(HOST_GID) /var/www/html/cache /var/www/html/tmp
+	# gpm runs as the host user, so the plugins it writes into ./user/plugins are
+	# owned by you, not root — no post-hoc chown, no root files to clean up later.
+	docker exec -u $(HOST_UID):$(HOST_GID) -w /var/www/html $(GRAV_CONTAINER) php bin/gpm install $(shell cat plugins.txt | tr '\n' ' ') -y
 	$(MAKE) apply-plugin-patches
 
 # Re-apply local fixes to git-ignored, GPM-managed third-party plugins. Run this