matrix: keep the secrets chown off Synapse's media store

The "Restricting permissions on the Synapse secrets" step chowned
$app_dir/data recursively, which also walks data/media_store — files
written by Synapse itself. Under rootless that is invisible (container
root maps to the docker install user, so everything is chownable), but in
rooted mode container root IS host root: the chown runs as the manager and
would fail per file, then fail the step, over files that must keep their
own ownership anyway. Same shape as the stoat fix, caught before it bit.

Scoped to the top-level files the hook actually writes — homeserver.yaml,
log.yaml, signing.key, .lp-admin-token — which is what the step name means.

Note this app was NOT producing the stoat symptom today: matrix's postgres
data lives at $app_dir/postgres, outside the directory being walked.
element/ keeps its recursive chown: one LibrePortal-written config.json
the container never writes.

Verified: reinstall clean, exit 0, homeserver.yaml + signing.key still
0600, media_store untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

containers/matrix/scripts/matrix_install_hooks.sh

@@ -238,7 +238,15 @@ matrix_install_post_compose()
     checkSuccess "Writing homeserver.yaml (server_name=$server_name registration=$enable_registration)"
 
     runFileOp chmod 600 "$homeserver_file" "$data_dir/signing.key"
-    runFileOp chown -R "$docker_install_user":"$docker_install_user" "$data_dir"
+    # Top-level files only (homeserver.yaml, log.yaml, signing.key, the admin
+    # token) — the ones this hook writes and the step name refers to. The
+    # recursion this replaces also walked data/media_store, whose contents belong
+    # to Synapse. That is harmless under rootless, where container-root maps to
+    # the docker install user, but in ROOTED mode those files are host-root and
+    # the chown runs as the manager: "Operation not permitted" per file plus a
+    # failed step, for files that must keep their own ownership regardless.
+    runFileOp find "$data_dir" -maxdepth 1 -type f \
+        -exec chown "$docker_install_user":"$docker_install_user" {} +
     checkSuccess "Restricting permissions on the Synapse secrets"
 
 }