ci: recover sudo-owned build metadata

Jenkinsfile

@@ -55,6 +55,19 @@ pipeline {
     stages {
         stage('Checkout') {
             steps {
+                withCredentials([usernamePassword(
+                    credentialsId: "${NODE_CREDENTIALS}",
+                    usernameVariable: 'JENKINS_NODE_USERNAME',
+                    passwordVariable: 'JENKINS_NODE_PASSWORD'
+                )]) {
+                    sh '''
+                        set -euo pipefail
+                        if [ -d "$WORKSPACE/.ci" ]; then
+                          printf '%s\n' "$JENKINS_NODE_PASSWORD" | \
+                            sudo -S -p '' chown -R -- "$(id -u):$(id -g)" "$WORKSPACE/.ci"
+                        fi
+                    '''
+                }
                 deleteDir()
                 checkout scm
             }
@@ -375,6 +388,10 @@ pipeline {
                     if [ -f "$DOCKER_CONFIG/config.json" ]; then
                       : >"$DOCKER_CONFIG/config.json"
                     fi
+                    if [ -d "${CI_ROOT:-}" ]; then
+                      printf '%s\n' "$JENKINS_NODE_PASSWORD" | \
+                        sudo -S -p '' chown -R -- "$(id -u):$(id -g)" "$CI_ROOT" || true
+                    fi
                 '''
             }
             cleanWs(deleteDirs: true, notFailBuild: true)