[P3][ci] Run Docker image as non-root user

[cevheri]

Summary

Docker image runs as root — bind-mounted volumes get root-owned files on host.

Audit ID: Section 4 Low — Wave 3
Location: Dockerfile:30

Fix

Switch to distroless :nonroot or add USER nonroot after copying artifacts; ensure write paths use volume with correct permissions.

Acceptance criteria

• Container runs non-root by default.
• CI docker build still passes.
• No changeset.

[cevheri]

Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.