docker: smoke-test the example pipeline in read-only mode

`shapepipe_run -c /app/example/config.ini` succeeds in docker because
the container filesystem is writable, but fails under apptainer/SIF
because OUTPUT_DIR=./example/output resolves under WORKDIR=/app which
is read-only:

  ERROR: [Errno 30] Read-only file system: './example/output/shapepipe_runs.txt'

The CI smoke test was passing while the apptainer path silently broke
— same class of gap dc13582 closed for `uv run pytest`, but for the
pipeline entry point.

Fix: a small wrapper `scripts/sh/shapepipe_run_example.sh` that
mktemp's a workdir, copies /app/example into it, cd's, and execs
shapepipe_run. The existing Dockerfile auto-symlink rule makes it
available as `shapepipe_run_example` on $PATH.

The CI step switches to the wrapper and runs it under
`docker run --read-only --tmpfs /tmp:rw`, which emulates SIF
semantics. Any future regression that relies on a writable cwd will
fail here instead of silently breaking apptainer users.

Drive-by: tighten `.gitignore`'s example-output patterns from
`*shapepipe_run_*` (catches anything with that substring, including
this new wrapper) to `example/output/shapepipe_run_*`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: cailmdaley

.github/workflows/deploy-image.yml

@@ -63,10 +63,13 @@ jobs:
           docker run --rm "$IMAGE" weightwatcher --version
           docker run --rm "$IMAGE" psfex --version
 
-      - name: Test runtime — shapepipe entry point
+      - name: Test runtime — shapepipe entry point (read-only fs)
         run: |
           IMAGE=$(echo "${{ steps.meta-runtime.outputs.tags }}" | head -n1)
-          docker run --rm "$IMAGE" shapepipe_run -c /app/example/config.ini
+          # --read-only + tmpfs /tmp emulates apptainer/SIF semantics: only
+          # /tmp is writable. shapepipe_run_example wraps shapepipe_run so
+          # the example tree gets copied into a mktemp workdir before running.
+          docker run --rm --read-only --tmpfs /tmp:rw "$IMAGE" shapepipe_run_example
 
       # Build dev (reuses cached `base` layer)
       - name: Build dev (load)

.gitignore

@@ -130,7 +130,7 @@ dmypy.json
 # Pyre type checker
 .pyre/
 
-# Ignore example output
-*shapepipe_run_*
-*shapepipe_runs*
+# Ignore example output (generated under example/output/ by shapepipe_run)
+example/output/shapepipe_run_*
+example/output/shapepipe_runs*
 code

scripts/sh/shapepipe_run_example.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Run the bundled example pipeline against a writable copy of /app/example.
+#
+# Works under both docker (writable /app) and apptainer/SIF (read-only /app):
+# the example tree is copied into a fresh tmp workdir so the config's
+# relative paths (INPUT_DIR=./example/data/..., OUTPUT_DIR=./example/output)
+# resolve to writable locations.
+#
+# Extra args are forwarded to shapepipe_run, e.g.:
+#   shapepipe_run_example -v
+set -euo pipefail
+
+WORK="$(mktemp -d -t shapepipe-example-XXXXXX)"
+cp -r /app/example "$WORK/"
+cd "$WORK"
+exec shapepipe_run -c example/config.ini "$@"