test(docker): cover group-add privilege drop

[JMilthaler]

What does this PR do?

I'm running into the same supplementary-group issue described in NousResearch#75627. The requested regression test seemed straightforward, so I had an agent create and independently review it in hopes of unblocking NousResearch#75632 and getting the fix into the official branch.

This adds the requested real-image Docker regression test. It launches the built Hermes image with --group-add 1001, exercises the real /init → s6 cont-init → main-wrapper.sh → s6-setuidgid hermes lifecycle, and verifies both that the final command runs as UID 10000 and that supplementary GID 1001 survives the privilege drop.

The test uses explicit RUNTIME_UID= and RUNTIME_GROUPS= markers, including an exactly-one-marker assertion, so stage2 logging cannot produce a false positive.

Related Issue

Related to NousResearch#75627.

Adds the regression coverage requested on NousResearch#75632.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Added test_group_add_survives_main_wrapper_privilege_drop to tests/docker/test_main_invocation.py.
• Runs the repository's real built Docker image with --group-add 1001.
• Verifies the runtime command reached through main-wrapper.sh executes as Hermes UID 10000.
• Verifies GID 1001 remains present after s6-setuidgid calls initgroups().
• Uses uniquely prefixed output markers and exact marker-count validation to avoid false positives from container startup logs.

How to Test

1. Build the Docker image from this branch.

2. Set HERMES_TEST_IMAGE to the built image tag.

3. Run:

   scripts/run_tests.sh tests/docker/test_main_invocation.py -k group_add_survives_main_wrapper_privilege_drop --file-timeout 600 -v

Expected result: one test executes and passes, proving the final UID is 10000 and GID 1001 survives the full s6 privilege-drop path.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: GitHub-hosted Ubuntu runner with Docker, using the repository's real built image

The full Python suite was not run because this is a targeted Docker integration-test contribution. The requested real-image regression test executed successfully in GitHub Actions.

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — N/A; test-only change with an explanatory test docstring
• I've updated cli-config.yaml.example if I added/changed config keys — N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — N/A; this test is intentionally part of the Docker integration suite and is skipped where Docker is unavailable
• I've updated tool descriptions/schemas if I changed tool behavior — N/A

Screenshots / Logs

Real-image GitHub Actions verification:

• Run: https://github.com/JMilthaler/hermes-agent/actions/runs/31748128645
• Job conclusion: success
• Run group-add regression test step: success
• Result: 1 tests passed, 0 failed
• Tested commit contained the PR fix(docker): carry Compose group_add supplementary groups past s6 privilege drop (#75627) NousResearch/hermes-agent#75632 implementation commit plus this regression test.

Additional checks completed:

• Independent review: no concrete issues found
• ruff check tests/docker/test_main_invocation.py: passed
• python3 -m py_compile tests/docker/test_main_invocation.py: passed
• sh -n docker/stage2-hook.sh: passed
• git diff --check: passed