Make Dendrite's base and bin paths owned by root

Root runs create-account from the bin path, and the script was owned by the matrix user.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/custom/matrix-dendrite/tasks/setup_install.yml

@@ -10,6 +10,19 @@
 # SPDX-License-Identifier: AGPL-3.0-or-later
 
 ---
+# Owned by root: root runs the scripts in the bin path (e.g. `create-account`).
+# Whoever owns the base path could rename the bin path (even a root-owned one) and put another in its place.
+- name: Ensure Dendrite root-owned paths exist
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    mode: '0750'
+    owner: root
+    group: "{{ matrix_group_name }}"
+  with_items:
+    - "{{ matrix_dendrite_base_path }}"
+    - "{{ matrix_dendrite_bin_path }}"
+
 - name: Ensure Dendrite paths exist
   ansible.builtin.file:
     path: "{{ item.path }}"
@@ -20,8 +33,6 @@
   with_items:
     - path: "{{ matrix_dendrite_config_dir_path }}"
       when: true
-    - path: "{{ matrix_dendrite_bin_path }}"
-      when: true
     - path: "{{ matrix_dendrite_ext_path }}"
       when: true
     - path: "{{ matrix_dendrite_nats_storage_path }}"
@@ -150,11 +161,16 @@
     - src: labels.j2
       dest: "{{ matrix_dendrite_base_path }}/labels"
       mode: "0640"
-    - src: bin/create-account.j2
-      dest: "{{ matrix_dendrite_bin_path }}/create-account"
-      mode: "0750"
   register: matrix_dendrite_support_files_result
 
+- name: Ensure Dendrite scripts installed
+  ansible.builtin.template:
+    src: bin/create-account.j2
+    dest: "{{ matrix_dendrite_bin_path }}/create-account"
+    mode: "0750"
+    owner: root
+    group: root
+
 - name: Ensure matrix-dendrite.service installed
   ansible.builtin.template:
     src: "{{ role_path }}/templates/systemd/matrix-dendrite.service.j2"