fix(build): restore root user for framework image build (#5566)

Signed-off-by: oliver könig <okoenig@nvidia.com>

Author: ko3n1g

.github/scripts/test_docker_dependency_layers.sh

@@ -3,6 +3,7 @@ set -euo pipefail
 
 dockerfile="${1:-docker/Dockerfile.ci}"
 workflow="${2:-.github/workflows/cicd-main.yml}"
+fw_final_dockerfile="${3:-docker/Dockerfile.fw_final}"
 
 baseline_arg_line=$(grep -n '^ARG BASELINE_MCORE_REF$' "$dockerfile" | cut -d: -f1)
 baseline_clone_line=$(grep -n 'git clone --filter=blob:none --no-checkout' "$dockerfile" | cut -d: -f1)
@@ -24,6 +25,15 @@ trap 'rm -rf "$temporary_dir"' EXIT
 ((baseline_line < dispatched_copy_line))
 ((dispatched_copy_line < delta_line))
 
+fw_final_from_line=$(grep -n '^FROM ${NEMO_FW_FINAL_BASE_IMAGE} AS nemo_fw_final$' "$fw_final_dockerfile" | cut -d: -f1)
+fw_final_root_line=$(grep -n '^USER root$' "$fw_final_dockerfile" | cut -d: -f1)
+fw_final_clone_line=$(grep -n '^RUN git clone --depth 1 https://github.com/NVIDIA-NeMo/NeMo.git' "$fw_final_dockerfile" | cut -d: -f1)
+[[ -n "$fw_final_from_line" ]]
+[[ -n "$fw_final_root_line" ]]
+[[ -n "$fw_final_clone_line" ]]
+((fw_final_from_line < fw_final_root_line))
+((fw_final_root_line < fw_final_clone_line))
+
 grep -q -- '--mount=type=cache,target=/root/.cache/uv' "$dockerfile"
 if grep -q -- '--mount=type=secret,id=GH_TOKEN' "$dockerfile"; then
   echo "Baseline MCore clone must not require a GitHub token" >&2

docker/Dockerfile.fw_final

@@ -15,6 +15,9 @@
 ARG NEMO_FW_FINAL_BASE_IMAGE
 FROM ${NEMO_FW_FINAL_BASE_IMAGE} AS nemo_fw_final
 
+# The CI base image runs as UID 1000, while framework assembly writes to root-owned system paths.
+USER root
+
 WORKDIR /opt
 
 ##############################################################################