TautWeekly for Plex v0.9.7

v0.9.7 corrects ownership for commands started from Docker, Unraid, QNAP,
macOS Docker, and FreeBSD/Podman Console or exec sessions.

Diagnosis and correction

The container service already changes from root to the configured PUID/PGID
through its entrypoint. A separate docker exec or podman exec session
bypasses that entrypoint and starts as the image's root user. Preview and send
commands had a privilege-drop wrapper, but setup, verification, library/user
management, roster, asset repair, and schedule controls invoked PowerShell
directly. Those commands could create a root-owned configuration backup or log
under /data; later service-user operations then failed with access denied.

All supported container helper commands and wrapper-opened shell sessions now
enter through a shared launcher. It repairs legacy root-owned entries within
the dedicated /data filesystem, drops to the configured PUID/PGID, and only
then starts the shell, allowlisted helper, or newsletter mode. Host wrappers,
guided installers, runtime messages, the preview landing page, Unraid
template, and public guides use the corrected route.

Boundaries and privacy

The migration repair selects only root-owned entries below the configured
data root, does not follow symlinks, does not cross another mounted filesystem,
and refuses UID/GID 0. It does not make files world-writable and does not read,
display, copy, or publish private configuration, logs, viewing history,
recipient data, or generated newsletters.

Windows and native Linux already execute helpers as their dedicated service or
administrator-selected runtime identity and are not affected by the
container-exec defect. Their release archives remain available and unchanged
in behavior.

Validation

Command-routing regression tests cover NAS/Docker, macOS Docker, and
FreeBSD/Podman wrappers, argument preservation, helper allowlisting, and the
root-to-PUID/PGID transition. Container smoke coverage creates a sanitized
root-owned legacy log, proves it is repaired, proves the command runs under
the configured UID, and verifies that an out-of-data symlink target is not
changed. Release validation covers every archive, internal file manifest,
top-level SHA-256 checksums, and reproducible ZIP/TAR.GZ generation. The
published OCI image is built for both amd64 and arm64.

Platform baselines

• Windows Portable 1.8.0 (behavior unchanged)
• NAS/Docker Portable 1.2.1
• macOS Portable 1.1.1
• Native Linux 1.1.0 (behavior unchanged)
• FreeBSD/Podman 1.1.1