fix: use runuser for privilege drop and capture container stderr in logs

The container still exited immediately after the su-based fix.  can
interfere with TTY/stdin handling for interactive shells. Switch to
, which is root-only, skips PAM, and preserves file descriptors so
bash stays interactive.

Also improve container failure diagnostics:
-  now combines stdout and stderr
- This helps surface the real reason when a container exits with code 0

Quality gates:
- pytest tests/unit: 219 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/tests/unit/test_manifest_compiler.py

@@ -270,7 +270,7 @@ def test_compile_dockerfile_starts_as_root_and_drops_privileges() -> None:
     entrypoint = compile_entrypoint(manifest)
 
     assert "USER dev" not in dockerfile
-    assert 'exec su -l dev -s /bin/bash -c \'exec "$@"\' -- "$@"' in entrypoint
+    assert 'exec runuser -u dev -- "$@"' in entrypoint
 
 
 @pytest.mark.unit