observability: run prometheus/loki/grafana as 1000:1000 (rootless uid mapping)

Container root maps to a subuid that owns nothing under /opt, so the
data-dir writes fail. Container uid 1000 is the invoking user in
rootless podman. Fixes the awk service-block seam to use regex match.

tests/caddyfile.bats

@@ -124,10 +124,12 @@ CADDYFILE="$REPO_ROOT/dankclaw/Caddyfile"
     # 1000:1000 lets these containers write their /opt data dirs. Container
     # root would map to a subuid that owns nothing under /opt.
     local compose="$REPO_ROOT/dankclaw/compose.yaml"
-    local svc
+    local svc block
     for svc in prometheus loki grafana; do
-        local block
-        block=$(awk "/^  $svc:$/,/^  [a-z]/" "$compose" | grep -v "^  $svc:")
+        block=$(awk -v s="^  $svc:\$" '
+            $0 ~ s { inblk = 1; next }
+            inblk && /^  [a-z]/ { inblk = 0 }
+            inblk' "$compose")
         echo "$block" | grep -q 'user: "1000:1000"' || {
             echo "service $svc does not run as user 1000:1000"; return 1;
         }