Gate image builds on socktop CLI compatibility; fix agent probe; caps for entrypoint

- CI now builds the image locally on the (arm64) runner and runs
  scripts/verify-image-socktop-flags.sh before pushing: every --flag the
  restricted/session shells pass must be documented by the socktop
  binary actually installed in the image. Catches the 0.3.9 failure
  class (cached apt layer shipping a pre-flag socktop) at build time.
- Manifest adds CHOWN/DAC_OVERRIDE/FOWNER alongside SETUID/SETGID:
  with ALL dropped, uid 0 has no implicit file privilege and
  prepare_demo_home crash-looped on the demo-owned 700 home dir.
  Sessions still run with zero capabilities via setpriv.
- Agent liveness probe uses /proc instead of kill -0: without CAP_KILL
  even root gets EPERM signalling the socktop-user agent, so the old
  check false-alarmed in the pod logs.
- 0.3.11

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

kubernetes/03-deployment.yaml

@@ -85,7 +85,7 @@ spec:
 
       containers:
         - name: webterm
-          image: gt.wittyoneoff.com/jason/socktop-webterm:0.3.10
+          image: gt.wittyoneoff.com/jason/socktop-webterm:0.3.11
           imagePullPolicy: Always
 
           command: ["/docker-entrypoint.sh"]
@@ -180,6 +180,15 @@ spec:
               add:
                 - SETUID
                 - SETGID
+                # prepare_demo_home (entrypoint.sh) writes into and re-owns
+                # /home/demo, which the image ships as demo-owned 700. With
+                # ALL dropped, uid 0 has no implicit file privilege, so the
+                # three file caps must come back or the entrypoint crashes on
+                # mkdir/chown/chmod. Sessions still get zero caps — session-
+                # shell.sh drops them all via setpriv --inh-caps -all.
+                - CHOWN
+                - DAC_OVERRIDE
+                - FOWNER
             readOnlyRootFilesystem: false
             runAsUser: 0
             runAsGroup: 0