fix(make): build-assets drops privileges via --user; bump CLAUDE.md Grav to 2.0.7

Close the remaining root-owned bind-mount vector: build-assets (a docker
run, missed by the docker-exec fix in 209b804) now runs as the host
uid/gid with HOME=/tmp for npm's cache. Verified: build completes clean,
zero root-owned files under user/themes, bundles byte-identical.

Solution doc updated from "still open" to fixed; CLAUDE.md stack section
now matches the Dockerfile's Grav 2.0.7.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0195b3cDdMeize2Mm1FgC2aU

Makefile

@@ -90,7 +90,10 @@ build:
 	docker compose build
 
 build-assets:
-	docker run --rm \
+	# --user: outputs (node_modules, js/ bundles, css-compiled/) land in the
+	# tracked theme tree owned by the host user, not root. HOME=/tmp gives npm
+	# a writable cache when running as a non-root uid.
+	docker run --rm --user $(HOST_UID):$(HOST_GID) -e HOME=/tmp \
 	  -v $(PWD)/user/themes/intotheeast:/app \
 	  -w /app node:20-alpine \
 	  sh -c "npm install && npm run build"