fix(docker): ship /app owned by the runtime uid; run the boot-smoke in CI too (#1378)

* fix(release): give the Docker boot-smoke a writable /app, and run it in CI

The v1.2.0-alpha.3 release run died at "Boot-smoke Docker image": a bare
`docker run` of the distroless image has nowhere the uid-65532 server can
write — /app is root-owned, and the VOLUME /app/data anonymous volume is
created root-owned too — so config.Load failed on "writing default config:
open config.yaml: permission denied" and the container exited. Real
deployments bind-mount config.yaml and data/, which is why the image itself
is fine.

Move the smoke into Server/scripts/docker-smoke.sh, run the container with
`--tmpfs /app --tmpfs /app/data` (Docker's tmpfs default mode is 1777, so
the non-root server can write both), and call the same script from ci.yml's
docker-build job — loading the image it already builds — so the smoke is
exercised on every PR to main instead of for the first time at tag time.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(docker): ship /app and /app/data owned by the runtime uid so a bare run boots

The tmpfs approach did not survive CI: runc re-applies the underlying
directory's mode to a tmpfs mounted over an existing path, so /app stayed
root:755 and the write still failed. Fix the image instead of the harness:
stage /app/data in the builder, chown it to 65532, COPY --chown it into the
distroless stage before WORKDIR. Docker seeds the VOLUME's anonymous volume
from that image dir, ownership included, so `docker run <image>` with no
mounts now boots and answers /health — which is also the contract the smoke
should be testing, so it goes back to a bare `docker run`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Server/Dockerfile

@@ -15,11 +15,21 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
     -ldflags "-s -w -X main.version=${VERSION}" \
     .
 
+# Skeleton for the runtime image's working dir. The server writes its default
+# config.yaml to the cwd and the SQLite DB, cert and uploads under data/, and
+# it runs as uid 65532 — so both must be owned by that uid or a bare
+# `docker run` dies on boot with "writing default config: permission denied"
+# (a WORKDIR created by the final stage is root-owned, and Docker seeds the
+# VOLUME's anonymous volume from the image dir, ownership included). Staged
+# here because distroless has no shell to chown with.
+RUN mkdir -p /skel/app/data && chown -R 65532:65532 /skel/app
+
 # ─── Final stage ─────────────────────────────────────────────────────────────
 # gcr.io/distroless/static-debian12: no shell, includes CA certs (needed for
 # TLS/ACME) and timezone data. Attack surface is minimal.
 FROM gcr.io/distroless/static-debian12
 
+COPY --from=builder --chown=65532:65532 /skel/app /app
 WORKDIR /app
 
 COPY --from=builder /chatserver /chatserver