Fix sshd runtime directory permissions

[PabloZaiden]

Summary

• normalize /var/run/sshd ownership and mode after creation in the bundled runner
• add a regression test so permissive container umasks do not break sshd startup

Testing

• bun test tests/runtime.test.ts --test-name-pattern 'bundled runner script|buildStartRunnerScript'
• rebuilt the CLI and recreated the affected TypeScript-template devbox successfully

[Copilot]

Pull request overview

This PR hardens the bundled SSH runner’s startup by ensuring /var/run/sshd is created with safe ownership and permissions even when the container’s umask would otherwise produce permissive modes that can prevent sshd from starting.

Changes:

• Normalize /var/run/sshd to root:root with mode 0755 in src/runner/ssh-server.sh.
• Add a regression test that asserts the bundled runner script includes the directory creation + normalization steps.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
tests/runtime.test.ts	Adds a regression test asserting the bundled runner script enforces correct /var/run/sshd ownership and mode.
src/runner/ssh-server.sh	Applies chown root:root and chmod 0755 after creating /var/run/sshd to prevent umask-dependent failures.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.