fix(Jenkinsfile): avoid pod-level runAs; use nova-ci container runAs + checkout in nova-ci

Kubernetes plugin PodTemplateUtils.combine() only merges runAsUser/runAsGroup
into pod securityContext and drops fsGroup, so jnlp could not use the workspace.

- Remove pod securityContext from inline yaml (jnlp uses image default for agent dir).
- Set runAsUser/runAsGroup on nova-ci containerTemplate only.
- Run Code checkout inside container('nova-ci') so workspace files match build UID.

Author: espeer

Jenkinsfile

@@ -14,7 +14,9 @@
 //   https://nvidia.atlassian.net/wiki/spaces/BLOS/pages/2147264305/NFS+scratch+space+for+Blossom+Jenkins+job
 //   Export: ipp1-cdot01-col01:/vol/scratch1/scratch.epeer_blossom → mountPath /scratch
 //   Set job parameters RUN_AS_UID / RUN_AS_GID from `id` on a Linux host (same as wiki Step 3–4).
-//   fsGroup matches RUN_AS_GID so the jnlp workspace emptyDir is writable (non-root agent).
+//   Do not set pod-level securityContext.runAsUser: the Kubernetes plugin merge drops fsGroup and
+//   breaks jnlp's /home/jenkins/agent. jnlp stays image-default (root); nova-ci uses runAsUser below;
+//   Code checkout runs in container('nova-ci') so the workspace is writable by the build UID.
 // - TAP summary: GNU gawk + /usr/local/share/nova-ci/tap-summary.gawk (from ci/Dockerfile).
 // - CI image: see ci/Dockerfile — clang/llvm, ccache, make, git, colossus CLI (add in private layer),
 //   jq, curl, openssh-client, Rust-for-Linux (rustup nightly + rust-src / rustfmt / clippy), etc.
@@ -57,10 +59,6 @@ podTemplate(
 apiVersion: v1
 kind: Pod
 spec:
-  securityContext:
-    runAsUser: ${runUid.toInteger()}
-    runAsGroup: ${runGid.toInteger()}
-    fsGroup: ${runGid.toInteger()}
   volumes:
   - name: scratch
     nfs:
@@ -85,7 +83,9 @@ spec:
       name: 'nova-ci',
       image: ciImage,
       ttyEnabled: true,
-      command: 'cat'
+      command: 'cat',
+      runAsUser: runUid,
+      runAsGroup: runGid,
     )
   ]
 ) {
@@ -108,29 +108,31 @@ spec:
 
       stageName = 'Code checkout'
       stage(stageName) {
-        githubHelper.updateCommitStatus("${BUILD_URL}", "${stageName} Running", GitHubCommitState.PENDING)
-        if ('Open'.equalsIgnoreCase(githubHelper.getPRState())) {
-          checkout changelog: true, poll: false, scm: [
-            $class: 'GitSCM',
-            branches: [[name: "pr/${githubHelper.getPRNumber()}"]],
-            extensions: [],
-            userRemoteConfigs: [[
-              credentialsId: 'github-token',
-              url: githubHelper.getCloneUrl(),
-              refspec: '+refs/pull/*/head:refs/remotes/origin/pr/*'
-            ]]
-          ]
-        } else if ('Merged'.equalsIgnoreCase(githubHelper.getPRState())) {
-          checkout changelog: true, poll: false, scm: [
-            $class: 'GitSCM',
-            branches: [[name: githubHelper.getMergedSHA()]],
-            extensions: [],
-            userRemoteConfigs: [[
-              credentialsId: 'github-token',
-              url: githubHelper.getCloneUrl(),
-              refspec: '+refs/pull/*/merge:refs/remotes/origin/pr/*'
-            ]]
-          ]
+        container('nova-ci') {
+          githubHelper.updateCommitStatus("${BUILD_URL}", "${stageName} Running", GitHubCommitState.PENDING)
+          if ('Open'.equalsIgnoreCase(githubHelper.getPRState())) {
+            checkout changelog: true, poll: false, scm: [
+              $class: 'GitSCM',
+              branches: [[name: "pr/${githubHelper.getPRNumber()}"]],
+              extensions: [],
+              userRemoteConfigs: [[
+                credentialsId: 'github-token',
+                url: githubHelper.getCloneUrl(),
+                refspec: '+refs/pull/*/head:refs/remotes/origin/pr/*'
+              ]]
+            ]
+          } else if ('Merged'.equalsIgnoreCase(githubHelper.getPRState())) {
+            checkout changelog: true, poll: false, scm: [
+              $class: 'GitSCM',
+              branches: [[name: githubHelper.getMergedSHA()]],
+              extensions: [],
+              userRemoteConfigs: [[
+                credentialsId: 'github-token',
+                url: githubHelper.getCloneUrl(),
+                refspec: '+refs/pull/*/merge:refs/remotes/origin/pr/*'
+              ]]
+            ]
+          }
         }
       }