🐛 Fix entrypoint hijacking any passed command into daemon mode 🐛

- rootfs/usr/local/bin/entrypoint.sh: the "start all services" gate
  (`if [ "$START_SERVICES" = "yes" ] || [ -z "$1" ]`) always evaluated true
  on a first-run container regardless of $1, because START_SERVICES is
  force-set to "yes" whenever no PID file exists yet. This meant any
  command passed to `docker run` — `exec ...`, `sh -c ...`, `shell`, or an
  arbitrary program — was swallowed into the service-start+monitor branch
  before ever reaching the `case "$1"` statement that already handles
  those subcommands correctly, causing the container to hang as a
  persistent daemon instead of running the given command. Changed the
  condition to `if [ -z "$1" ]` so the daemon branch only fires when no
  command was given at all, matching the default case's own `$# -eq 0`
  check further down. Verified `bash -n` passes; script-lint confirms the
  edited block is clean (3 unrelated pre-existing findings logged to
  TODO.AI.md).
- TODO.AI.md: logged 3 pre-existing script-lint findings in this same
  file (two bare `exit` statements, one missing VERSION= stamp) found
  incidentally while linting the fix above — out of scope for this
  change since this file is regenerated wholesale from the shared
  upstream template.

TODO.AI.md

@@ -0,0 +1,17 @@
+# TODO.AI.md
+
+## script-lint findings in rootfs/usr/local/bin/entrypoint.sh (pre-existing, not fixed yet)
+
+Found while lint-checking the START_SERVICES gate fix (commit that changed
+`if [ "$START_SERVICES" = "yes" ] || [ -z "$1" ]; then` to `if [ -z "$1" ]; then`).
+These predate that change and are out of scope for it — this file is regenerated
+wholesale from the upstream template in AI.md Step 2, so the same issues likely
+exist in the template itself and in every other dockersrc/casjaysdevdocker repo
+built from it.
+
+- [ ] line 553 (`cron` case handler): bare `exit` with no code — use `exit 0`,
+  `exit 1`, or `exit "$?"` to be explicit
+- [ ] line 652 (`start` case handler): bare `exit` with no code — same fix
+- [ ] script header `##@Version 202607082023-git` has no matching `VERSION=`
+  assignment in the script body — add `VERSION="202607082023-git"` after the
+  header block to satisfy the version-stamp rule

rootfs/usr/local/bin/entrypoint.sh

@@ -481,8 +481,11 @@ SKIP_SERVICE_START="no"
 [ "$1" = "init" ] && SKIP_SERVICE_START="yes" && CONTAINER_INIT="yes"
 [ "$2" = "init" ] && SKIP_SERVICE_START="yes" && CONTAINER_INIT="yes"
 # - - - - - - - - - - - - - - - - - - - - - - - - -
-# Start all services if no pidfile and not skipping
+# Start all services only when no command was given at all — an explicit
-if [ "$START_SERVICES" = "yes" ] || [ -z "$1" ]; then
+# command (exec, shell, tail, or an arbitrary program) must reach the case
+# statement below instead of being swallowed into daemon/monitor mode, even
+# on a first run where START_SERVICES is force-set to "yes"
+if [ -z "$1" ]; then
   if [ "$SKIP_SERVICE_START" = "no" ]; then
     [ "$1" = "start" ] && shift 1
     [ "$1" = "all" ] && shift 1