fix(demo): SBOM-ingest workspace perms, small-box worker CPU cap, sandbox login hint

[haksungjang]

Three follow-ups found while standing up and demoing the Hetzner read-only demo (the BomLens → TRUSCA SBOM-upload path). None affects the currently-running demo (all worked around live); this makes the fixes durable in the repo.

Fixes

1. SBOM ingest 500 on a fresh deployment (bug #6)

Backend runs non-root (uid 1000, Dockerfile.prod); worker runs root (Dockerfile.worker). They share the /workspace named volume, whose fresh mount root is root:root 0755. The backend can't create sbom-ingest/<project_id>, so POST /v1/projects/{id}/sbom-ingest → PermissionError → HTTP 500. Source scans were unaffected (the root worker does that writing), which is why only SBOM upload broke.

Fix: new worker-boot hook tasks.workspace_prep — a worker_ready handler (mirrors tasks.trivy_db_bootstrap) that makes the shared workspace writable (mode 1777, the /tmp model) once at boot. The root worker is the natural owner of shared-volume perms, and a signal hook survives docker-compose.demo.yml's worker command override (an init-container/command fix would not). Idempotent, best-effort (logs on failure, never fatal).

2. install.sh fails on a host with < 4 CPUs (bug #1)

Base compose capped the worker at cpus: "4.0". Under Compose V2 a deploy.resources.limits.cpus greater than the host's online CPU count is a hard error at up (range of CPUs is from 0.01 to N), so install.sh's bring-up dies on a 2-vCPU box (the CAX11 / CX23 runbook default; the demo overlay caps to 2.0, so only the standalone install path hit this).

Fix: cap is now ${WORKER_CPU_LIMIT:-4.0}; install.sh clamps WORKER_CPU_LIMIT to the host CPU count (hosts with ≥ 4 CPUs keep the full 4.0). Documented in .env.example.

3. Login demo hint points sandbox users to the right account (UX)

The Demo Sandbox is team-scoped (Backend team) and not visible to the browse-oriented frontend-admin account the login helper advertises. A visitor following the hint can't find the scan/upload surface.

Fix: the demo login hint now notes that running a live scan or uploading a BomLens SBOM requires signing in as dev@demo.trustedoss.dev. EN + KO locales.

Tests

• tests/unit/tasks/test_workspace_prep.py — mode 1777, idempotency, OSError best-effort, worker_ready delegation, include-list registration. (Core logic validated locally; the pytest run needs CI's redis, same as the existing task tests.)
• install.sh clamp verified (2→2, 4→4, 8→4), bash -n clean.

Release

Target v0.19.1 after merge (server: git reset --hard v0.19.1 + IMAGE_TAG=0.19.1 + overlay up -d; the workspace-perm fix ships in the worker image, the CPU-cap in compose/install.sh, the hint in the frontend image).