[mikelangmayr]

• The venv was user:user and the checkout root-owned, so an operator could not pull, hotfix, or import a driver to test it. Updating a host needed sudo git pull, and pip install -e failed outright.
• install now gives both trees to the daemon account with the ops group writable, and setgid on directories so anything created later keeps the group rather than the creating operator's own.
• It grants no privilege they lack. Operators already edit /etc/hispec configs and restart daemons, so they already decide what the daemons run.
• Also registers the checkout as a git safe.directory. Since 2.35.2 git refuses a repository whose owner is not the caller, which group permissions do not satisfy, so the chown alone would leave git pull broken in a new way.
• Execute bits are preserved, so the venv keeps its interpreter, and plain files do not become executable.
• Six tests, checked against a regression: dropping the mode change fails two of them. The setgid assertion skips on macOS, which strips it for a non-root caller.