Fix NeoForge installer failing under runuser

mktemp -d creates a 0700 directory owned by root, so handing the downloaded
installer jar to the minecraft user via runuser failed with "Unable to access
jarfile". Relax the temp path to 0755/0644 — the installer is a public
download and holds nothing sensitive.

Also set HOME explicitly for the runuser invocation, since it otherwise
inherits root's and the installer writes a cache alongside it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

mc-service-setup.sh

@@ -130,9 +130,17 @@ if [ -n "$NFVER" ]; then
     curl -fsSL -o "$tmp/installer.jar" "$url" \
         || die "could not download $url — check the version number exists"
 
+    # mktemp -d gives root a 0700 directory, so the service user cannot read the
+    # jar out of it. Open up the path — the installer is a public download.
+    chmod 0755 "$tmp"
+    chmod 0644 "$tmp/installer.jar"
+
     # The installer writes into the working directory, so run it as the service
-    # user to avoid leaving root-owned files scattered through the share.
-    ( cd "$SHARE" && runuser -u "$MCUSER" -- java -jar "$tmp/installer.jar" --installServer ) \
+    # user to avoid leaving root-owned files scattered through the share. HOME is
+    # set explicitly because runuser otherwise leaves root's, and the installer
+    # writes a cache next to it.
+    ( cd "$SHARE" && runuser -u "$MCUSER" -- \
+        env HOME="$SHARE" java -jar "$tmp/installer.jar" --installServer ) \
         || die "NeoForge installer failed"
     rm -rf "$tmp"; trap - EXIT
 fi