fix: check root before sudo when creating /workspace symlink

The previous ordering checked SUDO before checking if the process was
already running as root. When Docker starts the container with a
non-root user, SUDO may be empty, but the real fix is that the
entrypoint should try root first (e.g. when the image is started as
root) and only then fall back to sudo.

- Reorder symlink creation logic: root first, then sudo, then best-effort
- Update unit test to assert root is checked before sudo

Quality gates:
- pytest tests/unit: 208 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/src/services/build/manifest_compiler.py

@@ -344,10 +344,10 @@ def compile_entrypoint(manifest: dict) -> str:
         lines.append("")
         lines.append("# Create /workspace compatibility symlink")
         lines.append("# / is owned by root, so we need root or passwordless sudo.")
-        lines.append('if [ -n "$SUDO" ]; then')
-        lines.append('    sudo ln -sfn "$WORKSPACE_TARGET" /workspace')
-        lines.append('elif [ "$(id -u)" = "0" ]; then')
+        lines.append('if [ "$(id -u)" = "0" ]; then')
         lines.append('    ln -sfn "$WORKSPACE_TARGET" /workspace')
+        lines.append('elif [ -n "$SUDO" ]; then')
+        lines.append('    sudo ln -sfn "$WORKSPACE_TARGET" /workspace')
         lines.append('else')
         lines.append('    ln -sfn "$WORKSPACE_TARGET" /workspace 2>/dev/null || true')
         lines.append('fi')