fix: repair Kubernetes worker pull PVC ownership

[MarcStdt]

Summary

• run Kubernetes worker-pull jobs as root so they can normalize extracted PVC ownership
• chown the pulled runtime root back to UID/GID 1000 after druid worker pull
• preserve registry config support and worker callback behavior

Why

LGSM normal installs in prod fail after worker pull because artifact contents land root-owned on the PVC while install/runtime procedures run as the druid image user. Project Zomboid currently fails with LGSM ownership checks, and the same pattern can affect other Steam-backed scrolls.

Tests

• go test ./internal/runtime/kubernetes
• go test ./...
• git diff --check

[druid-infra]

Error: This repo is not allowlisted for Atlantis.