Let the daemon receive docker stop's signal itself (closes #33)

entrypoint.sh now switches to the routewatch user with setpriv instead of
runuser. setpriv replaces itself with the daemon, so the daemon gets the stop
signal directly and has its full 60 seconds to shut down; runuser stayed in
between and killed the daemon 2 seconds after passing the signal on. setpriv
keeps the environment, so GOMEMLIMIT, MALLOC_ARENA_MAX and XDG_DATA_HOME still
reach the daemon, and the state directory stays
/var/lib/berlin.sneak.app.routewatch.

Model: opus-5-5

TODO.md

@@ -23,6 +23,10 @@ runs make check on main.
 
 # Completed Steps
 
+- 2026-09-28: `docker stop` no longer kills the daemon 2 seconds after the
+  stop signal: the entrypoint switches to the `routewatch` user with
+  `setpriv` instead of `runuser`, so the daemon receives the signal itself
+  and gets its full 60 seconds to shut down (closes #33)
 - 2026-09-28: ready to run under upaas: a set but invalid `PORT`,
   `XDG_DATA_HOME` or `MALLOC_ARENA_MAX` stops the start, the health
   check follows `PORT`, README "Running under upaas" section (closes