fix(render): chown mounted disk as root, drop to nanobot via setpriv

Dockerfile

@@ -40,8 +40,13 @@ RUN useradd -m -u 1000 -s /bin/bash nanobot && \
 COPY entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN sed -i 's/\r$//' /usr/local/bin/entrypoint.sh && chmod +x /usr/local/bin/entrypoint.sh
 
-USER nanobot
+# Start as root so the entrypoint can chown the freshly-mounted (root-owned)
+# Render disk, then it drops to the non-root nanobot user via setpriv.
+USER root
 ENV HOME=/home/nanobot
+# Ensure crash output reaches Render logs (app output is otherwise swallowed on
+# non-graceful exit). Baked in so it survives Blueprint syncs.
+ENV PYTHONUNBUFFERED=1 PYTHONFAULTHANDLER=1
 
 # Gateway health endpoint and optional WebUI/WebSocket channel ports
 EXPOSE 18790 8765

entrypoint.sh

@@ -1,15 +1,10 @@
 #!/bin/sh
+# Runs as root so we can fix ownership of a freshly-mounted persistent disk
+# (Render mounts new disks root-owned) before dropping to the non-root app user.
 dir="$HOME/.nanobot"
-if [ -d "$dir" ] && [ ! -w "$dir" ]; then
-    owner_uid=$(stat -c %u "$dir" 2>/dev/null || stat -f %u "$dir" 2>/dev/null)
-    cat >&2 <<EOF
-Error: $dir is not writable (owned by UID $owner_uid, running as UID $(id -u)).
+mkdir -p "$dir"
+chown -R nanobot:nanobot "$dir"
 
-Fix (pick one):
-  Host:   sudo chown -R 1000:1000 ~/.nanobot
-  Docker: docker run --user \$(id -u):\$(id -g) ...
-  Podman: podman run --userns=keep-id ...
-EOF
-    exit 1
-fi
-exec nanobot "$@"
+# Drop privileges to the non-root user and exec the app as PID 1 so signals
+# (SIGTERM / graceful shutdown) reach it directly.
+exec setpriv --reuid=nanobot --regid=nanobot --init-groups nanobot "$@"