🐛 Fix entrypoint hang and lost-interpreter bugs 🐛

- rootfs/usr/local/bin/entrypoint.sh:
  1. The "start all services" gate
     (`if [ "$START_SERVICES" = "yes" ] || [ -z "$1" ]`) always evaluated
     true on a first-run container regardless of $1, because
     START_SERVICES is force-set to "yes" whenever no PID file exists yet.
     Any command passed to `docker run` — `exec ...`, `sh -c ...`,
     `shell`, or an arbitrary program — was swallowed into the
     service-start+monitor branch before reaching the `case "$1"`
     statement that already handles those subcommands, hanging the
     container as a daemon instead of running the given command. Changed
     the condition to `if [ -z "$1" ]` so the daemon branch only fires
     when no command was given at all.
  2. The `*/bin/sh | */bin/bash | bash | sh | shell)` case branch
     unconditionally shifted $1 before `__exec_command "$@"` (a bare
     `exec "$@"`). For `docker run image sh -c 'cmd'` this turned the
     exec into `exec -c cmd` (command not found, exit 127) instead of
     `exec sh -c 'cmd'`. Split the branch: real interpreter names
     (*/bin/sh, */bin/bash, bash, sh) now pass through unshifted; the
     "shell" keyword (not a real interpreter) gets its own branch that
     shifts and prepends "sh" to any remaining args, or falls back to a
     bare `__exec_command` (exec bash -l) when none remain.
  Verified `bash -n` passes. Found and fixed upstream in
  dockersrc/go, confirmed identical in this repo's generated
  entrypoint.sh, and mechanically applied here with the same patch.

Dockerfile

@@ -82,15 +82,19 @@ ENV CARGO_INSTALL_ROOT=/rust-tools
 # Install all Rust tools for the target arch — prebuilt binaries ONLY, no source fallback.
 # Tools without prebuilts for the target arch are silently skipped (exit 0).
 # This cuts arm64 build time from hours to minutes.
+# One `cargo binstall` invocation PER tool — cargo-binstall resolves its whole
+# argument list before installing anything, so batching tools in one invocation
+# means a single tool with no prebuilt (--disable-strategies compile forbids the
+# cargo-install fallback) aborts the entire batch and silently installs nothing,
+# even for tools that resolved fine. Isolating each tool's `|| true` is required
+# for "skip what's missing, keep what's available" to actually work.
 RUN --mount=type=cache,id=cargo-registry-native,sharing=shared,target=/usr/local/cargo/registry \
     --mount=type=cache,id=cargo-git-native,sharing=locked,target=/usr/local/cargo/git \
     set -o pipefail; \
     RUST_TARGET="$(cat /tmp/rust-target)"; \
     # Disable telemetry prompt — required for non-interactive builds
     mkdir -p /usr/local/cargo && echo 'disable-telemetry = true' > /usr/local/cargo/binstall.toml; \
-    BINSTALL="cargo binstall -y --disable-strategies compile --target ${RUST_TARGET}"; \
-    # Core tools — most have prebuilts for both amd64 and arm64
-    $BINSTALL \
+    for tool in \
       cargo-binstall \
       cargo-edit \
       cargo-watch \
@@ -120,9 +124,7 @@ RUN --mount=type=cache,id=cargo-registry-native,sharing=shared,target=/usr/local
       cargo-sort \
       cargo-hack \
       dprint \
-      grcov || true; \
-    # Secondary tools — may or may not have prebuilts
-    $BINSTALL \
+      grcov \
       cargo-llvm-cov \
       cargo-tarpaulin \
       wasm-pack \
@@ -151,7 +153,10 @@ RUN --mount=type=cache,id=cargo-registry-native,sharing=shared,target=/usr/local
       flamegraph \
       probe-rs \
       sqlx-cli \
-      sea-orm-cli || true
+      sea-orm-cli; \
+    do \
+      cargo binstall -y --disable-strategies compile --target "${RUST_TARGET}" "${tool}" || true; \
+    done
 
 FROM ${PULL_URL}:${DISTRO_VERSION} AS build
 ARG TZ