fix: allow live pilot to write Docker volume

[Nickfost]

Summary

• run the proof writer as root inside the job-owned container
• preserve the non-root ephemeral runner and all scoped cleanup

Root cause

The runner image defaults to UID 1001, while a fresh Docker named volume is root-owned and not writable by that user. The first live attempt failed at /proof/result with permission denied.

Verification

• RED: generic pilot run 29451460747 failed at the volume write
• static diff: one changed argument; git diff --check passes
• GREEN: the single permitted live retry will verify the copied workflow end to end

Relates #7