quadlet: drop the userns identity model — rootless cannot map uid 997

Evidence from the failed first cutover: podman top shows container root
maps to dank (1000) under UserNS=host rootless (subuid range 100000:65536
cannot express 997), so PUID=997 fell back to root and PMS crash-looped on
write access to its 997:984-owned data root. Fleet model instead: PUID=0/
PGID=0 (container root = dank, same as jellyfin/copyparty data roots) and
deploy_plex chowns /var/lib/plexmediaserver to 1000:1000 inside the
first-cutover block. Zero bytes moved; rollback regains one chown -R
997:984 step, documented in Plex.md. Seam test pins PUID=0/PGID=0 and the
absence of any userns key.

scripts/deploy-remote.sh

@@ -672,10 +672,15 @@ deploy_plex() {
     if ! systemctl --user is-active -q plex.service; then
         # First cutover: retire the native package unit BEFORE starting the
         # container — both cannot own 32400. Mask (not disable): on these hosts
-        # `systemctl disable` deletes the unit file itself; mask keeps an
-        # instant byte-safe rollback while nothing is signed off yet.
+        # `systemctl disable` deletes the unit file itself; mask keeps a
+        # one-command rollback while nothing is signed off yet.
         run_privileged systemctl stop plexmediaserver.service
         run_privileged systemctl mask plexmediaserver.service
+        # Rootless identity model: container root maps to the dank user
+        # (uid 1000) — real uid 997 is not mappable rootless. Adopt the data
+        # root into the fleet convention (jellyfin et al. run as 1000:1000).
+        # Rollback chowns it back to 997:984 before restarting the native unit.
+        run_privileged chown -R 1000:1000 /var/lib/plexmediaserver
     fi
     systemctl --user restart plex.service
     # Readiness gate: /identity answers MediaContainer XML once PMS is up;