fix(worker): remove cap_drop to allow nix to work in containers

Security is already provided by multiple isolation layers:
- NixOS container (systemd-nspawn)
- Podman container isolation
- RFC1918 network blocking via iptables
- Read-only repo mount
- Resource limits (memory, CPU, PIDs)

Author: mfw78

src/worker/builder/podman.rs

@@ -179,9 +179,10 @@ async fn run_build_in_container(
             cpu_period: Some(100000),
             cpu_quota: Some(state.config.container_cpu_quota),
             pids_limit: Some(state.config.container_pids_limit),
-            // Security hardening
+            // Security: prevent privilege escalation
+            // Note: We don't drop all capabilities since nix needs CHOWN/SETUID/etc.
+            // Security is provided by: NixOS container + Podman isolation + RFC1918 network blocking
             security_opt: Some(vec!["no-new-privileges:true".to_string()]),
-            cap_drop: Some(vec!["ALL".to_string()]),
             // Temp filesystem for build artifacts
             tmpfs: Some(
                 [("/tmp".to_string(), "size=2G,mode=1777".to_string())]