Harden drop-sudo on Linux

[viyatb-oai]

Summary

• discover group-authorized root-owned Linux service sockets under /run when applying drop-sudo
• remove the corresponding supplementary group memberships and restrict discovered sockets
• verify the boundary with a generic service-socket fixture on a hosted Linux runner and document the job-wide behavior change

Why

drop-sudo should also remove group-authorized access to existing root-owned service endpoints while preserving the default runner identity and workspace behavior.

Impact

Existing group-authorized root-owned service sockets under /run are restricted when drop-sudo runs. Workflows that need those endpoints after the action should move that work to a separate job or use a deliberately configured unprivileged user.

Validation

• corepack pnpm test
• corepack pnpm run check
• parsed action.yml and .github/workflows/ci.yml as YAML
• git diff --check
• hosted Verify TypeScript Build job, including the service-socket regression fixture