fix: stage a restored volume under /tmp, where the image can write

The image does not run as root, so the staging directory could not be created
at the container root: `mkdir /stage` failed with permission denied and every
restore would have failed. It goes under /tmp now, and the command is built as
one string instead of concatenated pieces inside the argument list.

Checked against a real volume and the published image: a truncated tar fails
and leaves the volume exactly as it was, and a whole one restores it.

tests/deploy/test_docker.py

@@ -130,7 +130,8 @@ class TestVolumes:
         assert args[-2] == "-c"
         assert "tar xf - -C /data" in args[-1]
         command = args[-1]
-        assert command.index("tar xf - -C /stage") < command.index("find /data -mindepth 1 -delete"), (
+        assert "mkdir -p /tmp/" in command, "the image does not run as root, so staging goes under /tmp"
+        assert command.index("tar xf - -C /tmp/") < command.index("find /data -mindepth 1 -delete"), (
             "the incoming tar is unpacked outside the volume first, so a corrupt one leaves it alone"
         )
         assert runner.streams[0][1] is not None, "the tar is fed in on stdin"