[fix] verify non-root container delivery (STAR-57)

[vt128]

The documented Docker invocation failed because the image used a shell CMD: passing -c replaced the command and Docker tried to execute -c itself. The image also ran as root on an obsolete distribution baseline.

Use a direct StarCLI entrypoint on Debian bookworm-slim, run as UID 65532, retain system CA certificates, and rely on the existing embedded time-zone data. Limit the build context to the prebuilt Linux binary. The README documents script mounts, resource limits, and loopback host publishing.

Closes the runtime-image portion of STAR-57; final release adoption remains tracked by STAR-104. Behavior changes: arguments now reach StarCLI directly; the working directory is /work, the image user is non-root, and the documented HTTP port is 8080. Shell use requires an explicit entrypoint override.

Validation:

• The new argument-forwarding regression fails against the old image (exit 127), then passes against the actual rebuilt linux/amd64 image.
• Container tests cover argument and exit forwarding, non-root execution, named time zones, a real CA bundle, rejection/acceptance of a local HTTPS certificate, real HTTP serving, and graceful docker stop under a read-only filesystem and resource limits. HTTPS tests use a local fixture, not a public network dependency.
• Build, full race tests twice, vet, formatting and diff checks pass. The Go 1.26.8 Docker build/race floor is also verified before commit.
• A required CI container job repeats the image build and integration tests; no container image or release is published by this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.34%. Comparing base (47966c1) to head (0b1eba9).

Additional details and impacted files

@@           Coverage Diff           @@
##           master      #35   +/-   ##
=======================================
  Coverage   86.34%   86.34%           
=======================================
  Files          23       23           
  Lines        1128     1128           
=======================================
  Hits          974      974           
  Misses        117      117           
  Partials       37       37           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.