fix: bypass AWF entrypoint in rootless artifact permission repair

[Copilot]

fixArtifactPermissionsForRootless ran docker without --entrypoint sh, causing AWF's entrypoint.sh to execute instead of the intended shell. That entrypoint waits 30s for an iptables-init container that never starts in the repair context, hanging then failing every rootless permission fix attempt.

Changes

• src/artifact-permissions.ts

  • Add --entrypoint sh flag to docker run; move sh from positional arg after imageRef to -c flag argument
  • Capture stdout alongside stderr for error reporting — the entrypoint timeout message writes to stdout, not stderr

• src/artifact-permissions.test.ts

  • Add test: logs stdout when stderr is empty and command writes only to stdout
  • Update mount-path assertion to verify --entrypoint sh and -c 'chown...' are present

• src/artifact-preservation-errors.test.ts

  • Update arrayContaining assertion to require --entrypoint, sh, and the -c command string

Before / after:

- imageRef,
- 'sh',
- '-c',
+ '--entrypoint', 'sh',
+ ...
+ imageRef,
+ '-c',
  'chown -R "$TUID:$TGID" /fix 2>/dev/null; chmod -R a+rwX /fix',

[Copilot]

Copilot wasn't able to review any files in this pull request.