The image creates SWW_STATE_DIR when it is missing (closes #337)

Before waf starts, share/sww.run makes SWW_STATE_DIR if it is missing,
gives it to sww:sww and sets its mode to 0700. A setting that is not an
absolute path, or a SWW_STATE_DIR_FILE that cannot be read, still
changes nothing. script/example-app now checks that a waf container
whose SWW_STATE_DIR does not exist becomes healthy with the directory
made for sww, mode 0700.

Model: opus-5-5

SPEC.md

@@ -2507,11 +2507,11 @@ It sets no `ENTRYPOINT` or `USER` of its own. The container must start
 - The image's `run` script is `/etc/service/sww/run`. It starts `waf` when
   `SWW_COMMAND` is `waf`, and `rproxy` when it is `rproxy`, unset or empty. It
   runs either as the `sww` user (uid and gid 65532), with runit's `chpst`. For
-  `waf`, it first makes `SWW_STATE_DIR` and every file in it belong to that
-  user. It also makes `SWW_CACHE_DIR` if it is missing, and gives it and every
-  file in it to that user. For `rproxy` it changes no owner. With any other
-  value, it starts nothing, and stops with a message naming `SWW_COMMAND` and
-  its value.
+  `waf`, it first makes `SWW_STATE_DIR` if it is missing, gives it and every
+  file in it to that user, and sets its mode to `0700`. It also makes
+  `SWW_CACHE_DIR` if it is missing, and gives it and every file in it to that
+  user. For `rproxy` it changes no owner. With any other value, it starts
+  nothing, and stops with a message naming `SWW_COMMAND` and its value.
 
 Every `run` script, the app's included, is a bash script. It starts with
 `#!/usr/bin/env bash` and `set -euo pipefail`, and puts its code in a `main`