fix(docker): make the embedded binary executable in the image

GitHub artifacts don't preserve the executable bit, so the binary the deploy job
downloads and packages is 0644, and the scratch image can't exec it — the
published image failed at startup with "/smocker ... not executable". COPY
--chmod=0755 sets the mode at copy time, fixing both the artifact-based deploy
build and local builds.

The build-job smoke test missed this because it builds the binary locally (0755)
rather than from the uploaded artifact.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: gwleclerc

Dockerfile

@@ -15,7 +15,9 @@ ARG TARGETOS
 ARG TARGETARCH
 ARG TARGETVARIANT
 COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-COPY build/smocker-${TARGETOS}-${TARGETARCH}${TARGETVARIANT} /smocker
+# --chmod: GitHub artifacts don't preserve the executable bit, so the downloaded binary the
+# deploy job packages is 0644 — force 0755 here or scratch can't exec it.
+COPY --chmod=0755 build/smocker-${TARGETOS}-${TARGETARCH}${TARGETVARIANT} /smocker
 # Run unprivileged (nobody); ports are >1024 and a mounted persistence dir must be writable by it.
 USER 65534:65534
 ENTRYPOINT ["/smocker"]