Gate image builds on socktop CLI compatibility; fix agent probe; caps for entrypoint

- CI now builds the image locally on the (arm64) runner and runs
  scripts/verify-image-socktop-flags.sh before pushing: every --flag the
  restricted/session shells pass must be documented by the socktop
  binary actually installed in the image. Catches the 0.3.9 failure
  class (cached apt layer shipping a pre-flag socktop) at build time.
- Manifest adds CHOWN/DAC_OVERRIDE/FOWNER alongside SETUID/SETGID:
  with ALL dropped, uid 0 has no implicit file privilege and
  prepare_demo_home crash-looped on the demo-owned 700 home dir.
  Sessions still run with zero capabilities via setpriv.
- Agent liveness probe uses /proc instead of kill -0: without CAP_KILL
  even root gets EPERM signalling the socktop-user agent, so the old
  check false-alarmed in the pod logs.
- 0.3.11

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docker/entrypoint.sh

@@ -96,8 +96,10 @@ start_socktop_agent() {
     # Give it a moment to start
     sleep 1
 
-    # Check if it's running
-    if kill -0 $AGENT_PID 2>/dev/null; then
+    # Check if it's running. /proc, not kill -0: the agent runs as another UID
+    # and the pod's capability set strips CAP_KILL, so even root gets EPERM
+    # from a probe signal and the check would false-alarm.
+    if [ -d "/proc/$AGENT_PID" ]; then
         echo "  ✓ socktop-agent is running on port 3001"
     else
         echo "  ⚠ socktop-agent may have failed to start (check /tmp/socktop-agent.log)"