Third build runtime behind BuildRunner: unprivileged user namespace via bwrap with a prepared Debian rootfs, for hosts without Docker or root. The step starts with a one-line precondition check to run on the target webspace; the step-16 git metadata mounts port 1:1. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>