fix some test findings

test/Dockerfile

@@ -39,8 +39,12 @@ RUN useradd -m -u "$UID_ARG" -s /bin/bash -G wheel "$USERNAME"
 RUN printf '%%wheel ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/wheel-nopasswd \
     && chmod 440 /etc/sudoers.d/wheel-nopasswd
 
-USER "$USERNAME"
-ENV HOME="/home/$USERNAME"
+# Use a literal (not the ARG) for USER/ENV: the legacy builder can silently
+# ignore a `USER "$ARG"` when the variable resolves after a stage boundary,
+# leaving the container running as root (which breaks git ownership checks on
+# the mounted host-owned repo). The value is fixed at mathias by default anyway.
+USER mathias
+ENV HOME="/home/mathias"
 WORKDIR /dotfiles
 
 # ---------------------------------------------------------------------------
@@ -51,10 +55,10 @@ FROM base AS dev
 USER root
 RUN pacman -S --noconfirm --needed shellcheck
 
-USER "$USERNAME"
+USER mathias
 WORKDIR /dotfiles
 
-COPY --chown="$USERNAME" . /dotfiles
+COPY --chown=mathias . /dotfiles
 
 CMD ["bash", "test/lint.sh"]
 
@@ -65,7 +69,7 @@ CMD ["bash", "test/lint.sh"]
 # ---------------------------------------------------------------------------
 FROM base AS test
 
-USER "$USERNAME"
+USER mathias
 WORKDIR /dotfiles
 
 # The entrypoint drives the smoke tests. The repo is mounted at /dotfiles