Cherry-pick the unprivileged incremental-build container fix onto os-4.0-dev #5695

os-4.0-dev's copy of .github/workflows/incremental-build.yml still starts the self-hosted build container with --privileged -u root on linux-openstudio-2. #5682 removes --privileged on develop, but pull requests into os-4.0-dev (for example #5640) run that branch's copy of the workflow, so they still get a privileged container on the same runner. A privileged container is effectively root on the runner host.

develop hasn't been merged into os-4.0-dev since May, so the fix won't arrive on its own.

Suggested fix

@kbenne, could you cherry-pick b1e6998 onto os-4.0-dev? It's the same one-line change as #5682, applied to os-4.0-dev's copy of the workflow, and nothing else:

-      options: --privileged -u root -e "LANG=en_US.UTF-8"
+      options: -u root -e "LANG=en_US.UTF-8"

git fetch origin incremental-unprivileged-os-4.0-dev
git checkout os-4.0-dev
git cherry-pick b1e699812b
git push origin os-4.0-dev

The commit is on the branch incremental-unprivileged-os-4.0-dev. Alternatively, merging develop into os-4.0-dev after #5682 lands brings the change along with everything else.

Why it should be safe

• On develop, the unprivileged container passed on linux-openstudio-2: run 42916173000 built and passed all 4190 tests.
• os-4.0-dev still uses the older jammy-main image. This job ran without --privileged on that image until Dec 2025, with 38 successful runs.
• The flag was copied from full-build.yml, where it's needed for a swapon step this job doesn't have.

Verifying

After the change is on os-4.0-dev, the next labeled PR into it should run unprivileged. Note that adding the Pull Request - Ready for CI label alone doesn't start a run (the pull_request trigger has no labeled type). A push or a close/reopen after labeling does.

Not fixed by this

Dropping --privileged doesn't fully isolate jobs on this runner. The remaining work has to happen on the runner itself, not in workflow files, and needs a separate fix.