The image creates SWW_STATE_DIR when it is missing (closes #337)

Before `waf` starts, the image's `run` script now makes `SWW_STATE_DIR` if it is missing (`mkdir -p`), gives it to `sww:sww` and sets its mode to `0700`, as it already does for the cache directory's owner. A value that is not an absolute path, or an unreadable `SWW_STATE_DIR_FILE`, still changes nothing, and `waf` stops naming the setting. The `Dockerfile` comment, `docs/image.md`, `docs/settings.md` and `SPEC.md` say the image makes the directory. `script/example-app` checks that a missing `SWW_STATE_DIR` is made, owned by `sww` with mode `0700`.

- `chmod 0700` also applies to an existing directory, a mounted volume included, at every start of `waf`.

Model: opus-5-5

SPEC.md

@@ -2507,11 +2507,11 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
 - The image's `run` script is `/etc/service/sww/run`. It starts `waf` when
   `SWW_COMMAND` is `waf`, and `rproxy` when it is `rproxy`, unset or empty. It
   runs either as the `sww` user (uid and gid 65532), with runit's `chpst`. For
-  `waf`, it first makes `SWW_STATE_DIR` and every file in it belong to that
-  user. It also makes `SWW_CACHE_DIR` if it is missing, and gives it and every
-  file in it to that user. For `rproxy` it changes no owner. With any other
-  value, it starts nothing, and stops with a message naming `SWW_COMMAND` and
-  its value.
+  `waf`, it first makes `SWW_STATE_DIR` if it is missing, gives it and every
+  file in it to that user, and sets its mode to `0700`. It also makes
+  `SWW_CACHE_DIR` if it is missing, and gives it and every file in it to that
+  user. For `rproxy` it changes no owner. With any other value, it starts
+  nothing, and stops with a message naming `SWW_COMMAND` and its value.
 
 Every `run` script, the app's included, is a bash script. It starts with
 `#!/usr/bin/env bash` and `set -euo pipefail`, and puts its code in a `main`