Agent generate_tts fails on every page (5 failed, no reason) while the editor TTS button works: /app/data volume is root-owned and the failure is swallowed

What happens

With the pro workbench / agent runtime enabled, the agent's generate_tts tool answers Narration audio: 0 generated, 0 skipped, 5 failed. on every page, while the editor's regenerate all narration button on the same page (POST /api/generate/tts, same provider, same key) succeeds 5/5. The tool result gives no reason, and the assistant tells the user "narration could not be added" — after having spent ~40 s (and provider quota) per page.

Why

• The editor route returns the audio bytes to the browser; the agent path persists them on disk with persistClassroomMediaBytes under <cwd>/data/classrooms/<stage>/media (lib/server/classroom-media-bytes.ts).
• The runner image (Dockerfile) never creates /app/data and switches to USER nextjs. A volume mounted at /app/data (the obvious way to keep classroom media across deploys) is therefore created root-owned by Docker, and fs.mkdir/writeFile fail with EACCES.
• lib/server/agent-runtime/scene-tts.ts catches per-action errors with failed.push(action.id) only — the message is dropped, nothing is logged, and the provider has already been called and billed for each line.

Reproduce

docker compose with volumes: [openmaic-data:/app/data], then in the container: id; ls -ld /app/data; touch /app/data/.w → uid=1001(nextjs), drwxr-xr-x root root, Permission denied. Ask the workbench assistant to "add narration to page 1".