fix: security hardening batch — pip env var, gosu SHA256, user churn, README, linter config

[libre-7]

Changes

Batch of security hardening fixes for simplex-bridge:

Dockerfile

• Replace --break-system-packages flag with PIP_BREAK_SYSTEM_PACKAGES=1 env var — avoids bypassing PEP 668 protection directly
• Fix gosu SHA256 verification — use sha256sum -c with a temp checksum file instead of fragile sed path rewriting that would break if upstream changes the checksum file format
• Add .hadolint.yaml — suppress known false positives (DL3008, DL3059)

entrypoint.sh

• Avoid unnecessary userdel/groupdel on every restart — only recreate the simplex user when UID/GID actually changed. Reduces filesystem churn and startup time

Housekeeping

• Remove stale patch-hermes-simplex.sh reference from .dockerignore (file doesn't exist on main)
• Remove stale compatibility note from README referencing deleted feat/hermes-v0.16.0 branch

Verification

• All changes are backward-compatible — no env var or interface changes
• Hadolint passes with suppressed false positives
• Shell syntax verified

[libre-7]

Rebased onto post-#17 main. Scope reduced to this PR's unique contributions:

• conditional simplex user/group recreation (skip userdel/groupdel churn when UID/GID already match)
• .hadolint.yaml ignores (DL3008/DL3059)
• gosu SHA256 verification robustness (explicit checksum file + separate sha256sum -c so the sed pipe can't mask failures)

Dropped as superseded by #17: pip --no-cache-dir/--break-system-packages, sudo removal, README compat-line removal (line was since updated on main), websockets pin.

Websockets pin resolution: PyPI latest stable at execution time is 17.0.1 — identical to what #17 already pinned, so the single pin everywhere is websockets==17.0.1. No version change needed.