fix(docker): run as non-root so claude bypassPermissions works

[krrish-berri-2]

Summary

Followup to #11 / #12. Latest deploy got past no_skill, surfaced:

karpathy_failed pr=26610 err=no_json rc=1 stderr_tail=
--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons

karpathy_check.py hard-codes --permission-mode bypassPermissions in _invoke_claude(), and claude refuses that mode under uid 0. The container was inheriting the default root user from python:3.12-slim, so every karpathy invocation aborted before producing any JSON.

Fix

• Create a bot user (uid 1000) with --create-home.
• Clone /opt/litellm as bot so per-call git fetch origin pull/N/head and git worktree add succeed without sudo.
• Install claude under bot's $HOME so the binary lives at /home/bot/.local/bin/claude — the path the runtime user can actually exec.
• USER bot before CMD.

/app stays root-owned — bot only needs read access there, karpathy's per-call tempdirs go to /tmp, and _persist_run writes to Postgres rather than disk.

Test plan

• Render Docker build succeeds and the new deploy goes live
• First @-mention against a 5/5-eligible PR (e.g. fix: increase health check max_tokens default to 16 (#23836) litellm#26610) logs karpathy_done instead of karpathy_failed
• review_pr.karpathy_ran=true shows up on the review_pr Logfire span

Made with Cursor