fix: recover staging deploy tree ownership

deploy/sync-staging-tree.sh

@@ -6,7 +6,15 @@ if [ "$#" -ne 2 ] || [ ! -d "$1" ] || [ ! -d "$2" ]; then
   exit 1
 fi
 
-rsync -az --delete \
+destination_deploy="$2/deploy"
+if [ -d "$destination_deploy" ] && [ ! -w "$destination_deploy" ]; then
+  docker run --rm --network none --read-only --user 0:0 \
+    --cap-drop ALL --cap-add CHOWN --security-opt no-new-privileges \
+    -v "$destination_deploy:/destination" postgres:17-alpine \
+    chown -R "$(id -u):$(id -g)" /destination
+fi
+
+rsync -az --delete --no-owner --no-group \
   --exclude='/.git/' \
   --exclude='/.env*' \
   --exclude='/.docker/' \