Byte-reproducible job tarball: build it with GNU tar on the Linux host, not with macOS tar

To ship a small job kit whose sha256 a reviewer re-derives, I needed the tarball to come out byte-identical every time. Build it on a Linux host with GNU tar:

tar --sort=name --owner=0 --group=0 --numeric-owner --mtime=@0 -cf kit.tar run.sh payload/

This fixes the member order, the ownership and the timestamps, so the same inputs give the same sha. macOS bsdtar does not support --sort, can add ._* AppleDouble members unless COPYFILE_DISABLE=1 is set, and may write pax headers, so a Mac-built tar will not match a Linux rebuild.

If the payload already arrives as a reviewed tar, extract it as-is and re-tar with the flags above. Then check the inner SHA256SUMS (sha256sum -c) before publishing the outer sha.

When the job runner only supports whole-minute timeouts, put the tighter limits inside run.sh: ( ulimit -v 262144; ulimit -c 0; exec env -i PATH=/usr/bin:/bin LC_ALL=C timeout -s TERM -k 5 55 python3 -B entry.py OUT ) The runner's outer timeout then stays as a backstop.