Gate image builds on socktop CLI compatibility; fix agent probe; caps for entrypoint

- CI now builds the image locally on the (arm64) runner and runs
  scripts/verify-image-socktop-flags.sh before pushing: every --flag the
  restricted/session shells pass must be documented by the socktop
  binary actually installed in the image. Catches the 0.3.9 failure
  class (cached apt layer shipping a pre-flag socktop) at build time.
- Manifest adds CHOWN/DAC_OVERRIDE/FOWNER alongside SETUID/SETGID:
  with ALL dropped, uid 0 has no implicit file privilege and
  prepare_demo_home crash-looped on the demo-owned 700 home dir.
  Sessions still run with zero capabilities via setpriv.
- Agent liveness probe uses /proc instead of kill -0: without CAP_KILL
  even root gets EPERM signalling the socktop-user agent, so the old
  check false-alarmed in the pod logs.
- 0.3.11

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/verify-image-socktop-flags.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Verify that the socktop binary baked into a built image understands every
+# --flag the restricted/session shells pass to it.
+#
+# Why this exists: image 0.3.9 shipped with a cached apt layer holding socktop
+# 1.60.1, while restricted-shell.sh had started passing --no-kill (added in
+# 1.60.2). 1.60.1 parsed the unknown flag as the positional websocket URL,
+# prompted to overwrite the 'local' profile with url "--no-kill", and broke the
+# demo. This check fails the build whenever the shells and the installed
+# binary disagree about the CLI.
+#
+# Usage: verify-image-socktop-flags.sh IMAGE
+set -euo pipefail
+
+IMAGE="${1:?usage: verify-image-socktop-flags.sh IMAGE}"
+cd "$(dirname "$0")/.."
+
+# Every --flag appearing on a socktop invocation line in the shells.
+FLAGS=$(grep -hE '/usr/bin/socktop' docker/restricted-shell.sh docker/session-shell.sh 2>/dev/null |
+    grep -oE -- '--[a-z][a-z-]*' | sort -u)
+if [ -z "$FLAGS" ]; then
+    echo "ERROR: found no socktop flags to verify — did the shells move?" >&2
+    exit 1
+fi
+
+# The image is arm64-only; pin the platform so the check behaves the same on
+# the arm64 CI runner and on an amd64 box with qemu binfmt.
+run_socktop() {
+    docker run --rm --platform linux/arm64 --entrypoint /usr/bin/socktop "$IMAGE" "$@" 2>&1
+}
+
+if ! VERSION=$(run_socktop --version); then
+    echo "ERROR: could not run socktop from ${IMAGE}:" >&2
+    echo "$VERSION" >&2
+    exit 1
+fi
+HELP=$(run_socktop --help || true)
+echo "image socktop: ${VERSION}"
+
+rc=0
+for flag in $FLAGS; do
+    if printf '%s' "$HELP" | grep -q -- "$flag"; then
+        echo "  ok: $flag"
+    else
+        echo "  MISSING: installed socktop does not document $flag" >&2
+        rc=1
+    fi
+done
+
+if [ "$rc" -ne 0 ]; then
+    echo "FAIL: the image's socktop predates flags the shells pass." >&2
+    echo "Bump SOCKTOP_VERSION in the Dockerfile to a release that has them." >&2
+fi
+exit $rc