fix(Jenkinsfile): set pod fsGroup so nova-ci can write workspace@tmp

Build #31 reached Code checkout cleanly (shallow clone worked) but the
first sh step in nova-ci failed with:

  process apparently never started in
  /home/jenkins/agent/workspace/nova-cicd@tmp/durable-cf27346a
  script returned exit code -2

jnlp (image-default jenkins user, typically uid 1000) created the
workspace before nova-ci started; durable-task in nova-ci then runs as
the NIS uid and tries to mkdir workspace@tmp/durable-<id>/, which is
denied because the parent dir is owned by uid 1000:1000 and not
group-writable.

Set pod securityContext.fsGroup = RUN_AS_GID. Kubernetes recursively
chowns / sets g+rwxs on emptyDir volumes for the fsGroup and adds it as
a supplementary group to every container in the pod, so:

- jnlp keeps writing as its image-default user (now also fsGroup),
- nova-ci's NIS uid (whose primary gid IS fsGroup) can mkdir/write
  inside the shared workspace.

runAsUser/runAsGroup stay on the nova-ci container; only fsGroup is set
at pod scope, so PodTemplateUtils.combine() has nothing to merge into
pod securityContext and won't drop fsGroup (the regression seen on
claude-broke-it when runAs was also at pod scope).

Signed-off-by: Edwin Peer <epeer@nvidia.com>

Author: espeer

Jenkinsfile

@@ -31,6 +31,12 @@
 //   pod scope makes the jnlp inbound-agent run as the NIS uid and crash with
 //   AccessDeniedException: /home/jenkins/agent (the agent workdir is owned by the image's
 //   default jenkins user). Only nova-ci needs the NIS uid for NFS /scratch access.
+// - Pod securityContext.fsGroup = RUN_AS_GID is required so the shared workspace emptyDir is
+//   group-writable. jnlp (image-default user, typically uid 1000) creates the workspace first;
+//   nova-ci's durable-task sh then needs to create workspace@tmp/durable-<id>/ as the NIS uid.
+//   Without fsGroup that fails with "process apparently never started" / exit code -2 (build #31).
+//   Only fsGroup is set at pod scope — runAs lives on the container — so PodTemplateUtils.combine()
+//   has nothing to merge into pod securityContext and won't drop fsGroup.
 
 @Library('blossom-github-lib@master')
 import ipp.blossom.*
@@ -76,6 +82,8 @@ podTemplate(
 apiVersion: v1
 kind: Pod
 spec:
+  securityContext:
+    fsGroup: ${runGid.toInteger()}
   volumes:
   - name: scratch
     nfs: