fix: use login shell when dropping privileges in manifest entrypoint

The generated entrypoint used a brittle  invocation that could
spawn a non-interactive bash and exit immediately, causing containers to
stop with exit code 0 right after startup.

- Switch to  so the
  container user gets a login shell and stdin/tty are preserved
- Update the unit test assertion for the new drop-privileges command

Quality gates:
- pytest tests/unit: 219 passed
- ruff: clean on changed files
- mypy: clean on changed files

apps/api/tests/unit/test_manifest_compiler.py

@@ -270,7 +270,7 @@ def test_compile_dockerfile_starts_as_root_and_drops_privileges() -> None:
     entrypoint = compile_entrypoint(manifest)
 
     assert "USER dev" not in dockerfile
-    assert 'exec su -s /bin/bash -c "exec \\"$@\\"" dev -- "$@"' in entrypoint
+    assert 'exec su -l dev -s /bin/bash -c \'exec "$@"\' -- "$@"' in entrypoint
 
 
 @pytest.mark.unit