feat: robust arbitrary UID support for non-root containers

[ductiletoaster]

Enable running the image as any UID (e.g., K8s securityContext.runAsUser) without prior configuration:

• Dynamically inject /etc/passwd entry for unknown UIDs in the entrypoint so getpwuid(), getpass.getuser(), and expanduser("~") work correctly (standard practice per OpenShift arbitrary UID guidelines)
• Make /etc/passwd group-writable at build time for runtime injection
• Make /app/.cache world-writable for uv/pip cache operations
• Document arbitrary UID support in running guide

Code Review

Description

Please include a summary of the changes including relevant motivation and context. List any dependencies that are required for this change.

Please check the option(s) that are most relevant.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactor (non-breaking modification to existing code path)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

Testing & Verification

Please describe the tests that you ran to verify your changes.

• Provide instructions to reproduce with relevant details for your test configuration.
• Include screenshots and/or videos showing the results of your changes.