Gate image builds on socktop CLI compatibility; fix agent probe; caps for entrypoint

- CI now builds the image locally on the (arm64) runner and runs
  scripts/verify-image-socktop-flags.sh before pushing: every --flag the
  restricted/session shells pass must be documented by the socktop
  binary actually installed in the image. Catches the 0.3.9 failure
  class (cached apt layer shipping a pre-flag socktop) at build time.
- Manifest adds CHOWN/DAC_OVERRIDE/FOWNER alongside SETUID/SETGID:
  with ALL dropped, uid 0 has no implicit file privilege and
  prepare_demo_home crash-looped on the demo-owned 700 home dir.
  Sessions still run with zero capabilities via setpriv.
- Agent liveness probe uses /proc instead of kill -0: without CAP_KILL
  even root gets EPERM signalling the socktop-user agent, so the old
  check false-alarmed in the pod logs.
- 0.3.11

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/build-and-deploy.yaml

@@ -84,6 +84,25 @@ jobs:
           username: ${{ secrets.REGISTRY_USERNAME }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
+      # Build into the runner's docker first (runner is arm64, so the image
+      # runs natively), gate on the CLI-compatibility check, and only then
+      # push. The layer cache makes the second build a no-op.
+      - name: Build Docker image (local, for verification)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./Dockerfile
+          platforms: linux/arm64
+          push: false
+          load: true
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:candidate
+          cache-from: type=registry,ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:buildcache
+
+      - name: Verify installed socktop understands the shells' flags
+        run: |
+          chmod +x scripts/verify-image-socktop-flags.sh
+          scripts/verify-image-socktop-flags.sh ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:candidate
+
       - name: Build and push Docker image
         uses: docker/build-push-action@v5
         with: