authentik: scope blueprints chown to avoid recursing into the mp0 bind mount

[MickLesk]

✍️ Description

should solve the issue, but i let the user test

🔗 Related Issue

Fixes #

✅ Prerequisites (X in brackets)

• Self-review completed – Code follows project standards.
• Tested thoroughly – Changes work as expected.
• No security risks – No hardcoded secrets, unnecessary privilege escalations, or permission issues.

---

🤖 AI Assistance (X in brackets)

If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you must confirm compliance below.
Select exactly one option.

• No AI used – Scripts were written without AI assistance.
• AI was used – I confirm the scripts were built using AGENTS.md and .github/agents/pve-script-creator.agent.md as guidance, and the output has been reviewed and corrected to match those guidelines.

---

🛠️ Type of Change (X in brackets)

• 🐞 Bug fix – Resolves an issue without breaking functionality.
• ✨ New feature – Adds new, non-breaking functionality.
• 💥 Breaking change – Alters existing functionality in a way that may require updates.
• 🆕 New script – A fully functional and tested script or script set.
• 🌍 Website update – Changes to script metadata (PocketBase/website data).
• 🔧 Refactoring / Code Cleanup – Improves readability or maintainability without changing functionality.
• 📝 Documentation update – Changes to README, AppName.md, CONTRIBUTING.md, or other docs.

---

💥 Breaking Change Advisory (only if you checked "Breaking change")

If this PR changes existing behaviour in a way that may require action before an
update, add a breaking-change advisory block to this PR body. The website and
the in-container update guard read it to tell operators exactly what to expect,
what to do first, and — with action: block — to stop an update until it's
handled. Every field is optional; the advisory auto-expires 30 days after merge.

Copy the block out of the comment below, fill it in, and paste it here:

[github-actions]

Try this branch

The engine and the scripts resolve independently, so this runs the changed
ct/ and install/ scripts against the production engine:

export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/community-scripts/ProxmoxVE/fix-authentik-update-chown-bind-mount-lost-found
bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/authentik.sh")"

Both lines are needed. Each script pins _CS_DEFAULT_URL to main, and that
pin is what fills COMMUNITY_SCRIPTS_URL when the variable is unset — so
curling the branch URL on its own gives you the ct/ script from this PR and
the install/ script from main. Frequently the one you meant to test.

The same command works on an Incus host: the engine detects the platform and
loads the matching backend, while the scripts still come from this branch.

Useful while testing

dev_mode=net logs every fetch with status and URL, which is the quickest way
to confirm the branch is really being used. dev_mode=keep stops a failed
build from deleting the container along with the evidence.

export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/community-scripts/ProxmoxVE/fix-authentik-update-chown-bind-mount-lost-found
dev_mode=net,keep bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/authentik.sh")"

[MickLesk]

approved by user; #16985 (comment)

[thieneret]

In line 231, it is not enough to just set the owner of the blueprints folder, the owner of all subfolders must be changed, however, the lost+found folder created when mounting volume 2 in the container is owned by nobody:nogroup and cannot be modified from the container, which is what causes the problem.
During my test yesterday, the -f switch worked, so I don't really understand what the problem could be now, but I'm investigating the problem.

[thieneret]

I tested it several times, it worked with find.
Meanwhile I found another error in the two sed lines.