fix: refresh image-managed dotfiles over the home volume on start (#89)

[BrettKinny]

Closes #89. v1.0 blocker — the bug lives in v1.0's headline feature (pull/compose upgrades).

Problem

docker-compose.yml / the GHCR install mounts only squarebox-home:/home/dev, so the named volume shadows the image-baked dotfiles (.bashrc, starship.toml). Docker seeds a volume from the image only at first creation, so upgraded containers silently keep whatever dotfile shipped when their volume was born — image updates never reach them.

This already bit rc1→rc2: PR #88's fzf keybindings stayed dead on upgraded shells. It also made #90 (sqrbx-help) embarrassing — the MOTD advertised a help screen documenting Ctrl+R/Ctrl+T shortcuts that were dead on those same upgraded containers.

Fix

• Ship managed dotfiles to a non-volume path (/usr/local/lib/squarebox/dotfiles/) the volume can't shadow.
• squarebox-entrypoint runs new refresh-dotfiles.sh on every start, re-seeding .bashrc/starship.toml over the (possibly stale) volume copy.
• Skips any path the operator bind-mounted (desktop install path) → host-managed files are never clobbered.
• Best-effort (set -uo pipefail, always exit 0, || true) → a dotfile refresh can never abort container boot.
• Runs as root before the privilege drop so refreshed files get the resolved PUID:PGID.

Verification (real containers, docker build + run)

• ✅ e2e dotfiles suite, 5/5: source present, refresh installed, live ~/.bashrc matches image source (proves start-time refresh ran), staled bashrc restored, refresh exits 0.
• ✅ Bind-mounted read-only host bashrc preserved untouched (mountpoint guard).

Changes

• scripts/squarebox-refresh-dotfiles.sh (new) — single source of truth
• scripts/squarebox-entrypoint.sh — call it at both exec points
• Dockerfile — ship managed dotfiles to the non-volume source + chmod
• scripts/e2e-test.sh — new dotfiles suite, wired into the sqrbx-update CI job (which gates publish)
• uat-checklist.md — manual cross-version upgrade scenario (e2e only simulates within one image)
• CLAUDE.md + dotfiles/bashrc header — document the dual mechanism

After this lands I'd cut v1.0.0-rc3, run the manual upgrade UAT, then tag v1.0.0.

🤖 Generated with Claude Code