good post, only one thing.
You dont need (read: should not) run as root.
There really are no necessary reason for running rpmbuild as root,
the %defatr section defines the default permissions (in your example user:root and group:root) you can, and should also set permission in the %files section as needed per folder/file, and in some cases the default %defattr root:root will result in eg configuration files not being readable by normal user (nemo)
As rpmbuild builds in ~/rpmbuild directory tree it is able to create the rpm as user nemo etc.