monster: Fix runner work-dir bind mount not taking effect

The initial bind mount over /run/github-runner did not actually keep
builds off tmpfs in CI; two issues surfaced:

- The mount was wantedBy the runner services, but those are ephemeral
  (Restart=always) and a systemd restart does not re-pull WantedBy deps.
  After the first job the mount was left unmounted and builds dropped
  back onto the 4G tmpfs, failing with ENOSPC. Bind it to
  multi-user.target so it stays mounted for the host's lifetime.

- The source dir was 0750, so the per-runner DynamicUser could not
  traverse the shared parent into its own RuntimeDirectory leaf, failing
  with EACCES on the build dir. Use 0755 to match the mode systemd gave
  the tmpfs parent before.

Author: znaniye

nix/hosts/monster/github-runner.nix

@@ -36,7 +36,7 @@ in
     trusted-users = runners;
   };
 
-  systemd.tmpfiles.rules = [ "d /var/lib/github-runner-work 0750 root root -" ];
+  systemd.tmpfiles.rules = [ "d /var/lib/github-runner-work 0755 root root -" ];
 
   systemd.mounts = [
     {
@@ -47,7 +47,7 @@ in
       requires = [ "systemd-tmpfiles-setup.service" ];
       after = [ "systemd-tmpfiles-setup.service" ];
       before = map (r: "github-runner-${r}.service") runners;
-      wantedBy = map (r: "github-runner-${r}.service") runners;
+      wantedBy = [ "multi-user.target" ];
     }
   ];