fix: use runuser for privilege drop and capture container stderr in logs

The container still exited immediately after the su-based fix.  can
interfere with TTY/stdin handling for interactive shells. Switch to
, which is root-only, skips PAM, and preserves file descriptors so
bash stays interactive.

Also improve container failure diagnostics:
-  now combines stdout and stderr
- This helps surface the real reason when a container exits with code 0

Quality gates:
- pytest tests/unit: 219 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/src/services/build/manifest_compiler.py

@@ -388,12 +388,12 @@ def compile_entrypoint(manifest: dict) -> str:
 
     # Drop from root to the container user before running the real command.
     # The Dockerfile no longer sets USER, so the entrypoint has root for the
-    # setup above. Use `su -l` to start a login shell as the container user
-    # and exec the original CMD, preserving TTY/stdin for interactive tools.
+    # setup above. `runuser` (root-only, no PAM) preserves the environment,
+    # stdin, and TTY so interactive tools like bash keep running.
     if user:
         name = user["name"]
         lines.append("# Drop privileges to the container user")
-        lines.append(f'exec su -l {name} -s /bin/bash -c \'exec "$@"\' -- "$@"')
+        lines.append(f'exec runuser -u {name} -- "$@"')
     else:
         lines.append('exec "$@"')
     return "\n".join(lines)