fix: handle volume permission issues for bind-mounted /data directory

Adds a gosu-based entrypoint that starts as root, fixes ownership of
/data and /tmp/workspace for the stirling user, then drops privileges.
This fixes "SQLITE database not found" errors when users bind-mount
host directories.

docker/entrypoint.sh

@@ -0,0 +1,12 @@
+#!/bin/sh
+set -e
+
+# Fix ownership of mounted volumes so the non-root stirling user can write.
+# This runs as root, fixes permissions, then drops to stirling via gosu.
+if [ "$(id -u)" = "0" ]; then
+  chown -R stirling:stirling /data /tmp/workspace 2>/dev/null || true
+  exec gosu stirling "$@"
+fi
+
+# Already running as stirling (e.g. Kubernetes runAsUser)
+exec "$@"