fix: chown var/t1 and var/t3 to simulator uid 10001 for k3d

Non-root drone pods need write access on the hostPath lake. Ansible now
creates var/t1 and var/t3 owned by uid 10001 instead of relying on 0777
alone after legacy root-owned parquet trees.

infra/ansible/sim-cluster.yml

@@ -29,12 +29,16 @@
         path: "{{ data_dir }}"
         state: directory
         mode: "0777"
+        owner: "10001"
+        group: "10001"
 
     - name: Create warehouse directory (T3 host path inside the k3d node)
       ansible.builtin.file:
         path: "{{ warehouse_dir }}"
         state: directory
         mode: "0777"
+        owner: "10001"
+        group: "10001"
 
     - name: List existing clusters
       ansible.builtin.command: k3d cluster list -o json

simulator/Dockerfile

@@ -7,6 +7,10 @@ COPY virtual_drone ./virtual_drone
 COPY monitoring ./monitoring
 COPY explorer ./explorer
 COPY tests ./tests
+RUN groupadd --gid 10001 swarm \
+    && useradd --uid 10001 --gid swarm --home-dir /app --shell /usr/sbin/nologin swarm \
+    && chown -R swarm:swarm /app
+USER swarm
 RUN pytest tests/ -q
 
 FROM python:3.12-slim
@@ -19,6 +23,11 @@ COPY virtual_drone ./virtual_drone
 # them without bind mounts (Compose overrides these with live mounts)
 COPY monitoring ./monitoring
 COPY explorer ./explorer
+RUN groupadd --gid 10001 swarm \
+    && useradd --uid 10001 --gid swarm --home-dir /app --shell /usr/sbin/nologin swarm \
+    && mkdir -p /data \
+    && chown -R swarm:swarm /app /data
 
 ENV DATA_DIR=/data
+USER swarm
 CMD ["python", "-m", "virtual_drone.main"]