fix: run container via entrypoint with PUID/PGID privilege drop

[MohandL3G]

Hi, this PR fixes the permission issue I ran into, with help from OpenCode. Here's what OpenCode wrote about the fix:

The problem
The image ran opencode as a hardcoded non-root user (opencode, UID 1000) via USER opencode. That works fine with named volumes, but breaks with bind mounts: Docker overrides the image's /home/opencode/.config and /home/opencode/.local with the host's folders, which are owned by a different UID/GID. opencode then fails at startup with EACCES: permission denied, mkdir '/home/opencode/.local/share/opencode/...'.

The fix
I replaced the static user with a linuxserver.io-style entrypoint (entrypoint.sh):

• The container now starts as root, so it can fix ownership before the app launches.
• The entrypoint reads PUID and PGID (defaulting to 1000:1000), remaps the opencode user and group to those IDs, chowns /home/opencode/.config and /home/opencode/.local, then drops privileges with setpriv --reuid --regid --clear-groups before executing opencode.
• The serve command moved into CMD, with the entrypoint as ENTRYPOINT.

What this means for users
Set PUID/PGID in your compose file to match your host user's IDs and the mounted data directories stay writable — no more chown-ing host folders to a hardcoded UID:

environment:
  - PUID=1000
  - PGID=1000

No changes are needed to the existing volumes or the update-image.yml workflow — the CI pipeline builds the image with the entrypoint automatically.