fix: use login shell when dropping privileges in manifest entrypoint

The generated entrypoint used a brittle  invocation that could
spawn a non-interactive bash and exit immediately, causing containers to
stop with exit code 0 right after startup.

- Switch to  so the
  container user gets a login shell and stdin/tty are preserved
- Update the unit test assertion for the new drop-privileges command

Quality gates:
- pytest tests/unit: 219 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/src/services/build/manifest_compiler.py

@@ -388,12 +388,12 @@ def compile_entrypoint(manifest: dict) -> str:
 
     # Drop from root to the container user before running the real command.
     # The Dockerfile no longer sets USER, so the entrypoint has root for the
-    # setup above.  Use `su -c` to preserve environment variables (HOME, PATH,
-    # WORKSPACE_NAME, etc.) and keep the container user as the running user.
+    # setup above. Use `su -l` to start a login shell as the container user
+    # and exec the original CMD, preserving TTY/stdin for interactive tools.
     if user:
         name = user["name"]
         lines.append("# Drop privileges to the container user")
-        lines.append(f'exec su -s /bin/bash -c "exec \\"$@\\"" {name} -- "$@"')
+        lines.append(f'exec su -l {name} -s /bin/bash -c \'exec "$@"\' -- "$@"')
     else:
         lines.append('exec "$@"')
     return "\n".join(lines)