docker: set up the data directory in an entrypoint (closes #166)

The runtime image no longer sets USER. Its new entrypoint,
deploy/docker-entrypoint.sh, runs as root: it creates the data
directory if needed, gives it and everything in it to the dnswatcher
user (uid 10001) with mode 700 on the directory, then runs dnswatcher
as that user with su-exec. A bind-mounted host directory, whether
empty and root-owned or holding a state file left by another uid, no
longer has to be chowned first, and the README's upaas section now says
only which path to mount. The startup check that the data directory is
writable stays.

Model: opus-5-5

TODO.md

@@ -23,8 +23,7 @@ Rationale, Design, TODO, License, Author) if any are still missing.
   `deploy/docker-entrypoint.sh`, starts as root, creates the data directory if
   needed, gives it and everything in it to the `dnswatcher` user with mode 700
   on the directory, then runs dnswatcher as that user with `su-exec`. A
-  bind-mounted host directory no longer has to be created or chowned first,
-  and the README no longer asks for it (closes #166).
+  bind-mounted host directory no longer has to be chowned first (closes #166).
 - 2026-09-29: `.golangci.yml` re-fetched unchanged from `sneak/prompts`. It
   replaces the deprecated `gomodguard` with `gomodguard_v2`, so `make lint` no
   longer warns about it, and turns on `depguard` with the org `test-support`