deb: build the rules as an unprivileged user in pkh chroots

Launchpad's buildds and sbuild compile as a non-root user, and
packages rely on it: coreutils' configure refuses to run as root
(the one remaining standard-tier e2e failure). Run the rules - and
the fakeroot-wrapped binary step - as an on-demand 'pkh-build' user
whenever the build runs in a context pkh controls (the ephemeral
chroot); ssh and schroot contexts keep their own user.

setpriv drops to the user without touching the environment, so the
dpkg architecture variables and DEB_BUILD_OPTIONS survive the
transition. The staged tree, the scratch HOME and the shared ccache
directory are handed to the user on every build; everything before
the rules (dependency installation, quilt) legitimately stays root.

Minimal mmdebstrap chroots carry no passwd package, so the user is
appended to /etc/passwd and /etc/group directly when useradd is
missing, as sbuild's build-user setup does.

src/deb/mod.rs

@@ -607,6 +607,9 @@ async fn build_binary_package_impl(
                     session.as_ref(),
                     build_resume,
                     ccache,
+                    // Rootless builds: only a context pkh controls (the
+                    // ephemeral chroot) can carry the on-demand build user.
+                    guard.is_some().then_some(local::BUILD_USER),
                     &mut timings,
                 )
                 .await?