fix(docker): address Ark0N's PR review on Update-Codeman.sh — fix the handoff, the build/down ordering, and default-clear the build volumes

Three blockers, all fixed and verified by actually running the script (not
just string-matching it):

1. `exec "$script_dir/Start-Codeman.sh"` failed EACCES/exit 126 on every
   checkout, since Start-Codeman.sh is committed non-executable (100644) —
   the same fact my own second commit on this branch established. Fixed to
   `exec bash "$script_dir/Start-Codeman.sh"`.

2. `down` ran before `build --no-cache`, so Codeman and every session it was
   running were offline for the entire rebuild, and a build failure left the
   stack down with nothing to bring it back — the exact ordering mistake
   Start-Codeman.sh's own "Build BEFORE taking the stack down" comment exists
   to prevent. Reordered to build, then down, then hand off.

3. The default path could throw the rebuild away: codeman-node-modules/
   codeman-dist only re-seed from the image while EMPTY, Start-Codeman.sh
   only clears them when it detects the checkout's HEAD or package-lock.json
   moved, and neither condition is true for the Dockerfile-only change this
   script exists for — so a plain `bash docker/Update-Codeman.sh` rebuilt an
   image whose fresh node_modules/dist then sat unused behind the old
   volumes. Made clearing them the default; `--keep-volumes` opts out
   (replaces the old `--volumes`/`-v` flag, which is no longer needed since
   clearing is now the default).

Smaller items from the same review, also fixed:

- The --no-cache build now derives PUID/PGID from CODEMAN_APPDATA_PATH's
  owner first, via the identical owner_of() helper Start-Codeman.sh uses
  (parity-tested) — without it, the build used Compose's default 1000:1000
  regardless of the real appdata owner (99:100 on the Unraid layout
  docker/README.md documents), and Start-Codeman.sh's own correctly-PUID'd
  build during the handoff would then rebuild those layers anyway, so the
  --no-cache image never actually shipped.
- docker/README.md's "rebuilds ... only when it detects ... moved" wrongly
  described BOTH the rebuild and the volume-clearing as conditional;
  Start-Codeman.sh rebuilds on every start, only the volume-clearing is
  conditional. Corrected, and reworded around the new default.
- --help/-h now prints usage and exits 0 instead of falling into the
  unrecognised-argument branch.
- "the ONLY named volumes this stack declares" now says docker-compose.yaml
  specifically, since a docker-compose.override.yml could add more.

New tests: PUID/PGID derivation parity with Start-Codeman.sh's owner_of(),
--help handling, and — the one that actually catches blocker #1, which five
source-string-matching tests did not — a real end-to-end smoke test: a
synthetic deployment, a stub `docker` on PATH logging every invocation, the
real script executed via a real subprocess. Confirms the real command
sequence (build --no-cache, then down --volumes or plain down, then evidence
the handoff genuinely ran Start-Codeman.sh) and that a working handoff fails
honestly at Start-Codeman.sh's own later check rather than with EACCES.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N6eadpRyqpA9PD3i139cSD

docker/README.md

@@ -43,23 +43,26 @@ changed, and asks you to run `Start-Codeman.sh` here on the host instead. Detail
 
 ### Major updates
 
-`Start-Codeman.sh` rebuilds the image and clears the build-artefact volumes on
-its own, but only when it detects the checkout's HEAD or `package-lock.json`
-moved — exactly right for an ordinary `git pull`, too conservative when a
-release note (or the updater's own blocker message) calls for starting over.
-For that case, `docker/Update-Codeman.sh` stops the stack, force-rebuilds the
-image with no layer cache, then hands off to `Start-Codeman.sh` for the usual
-start:
+`Start-Codeman.sh` rebuilds the image on every start, but only clears the
+`codeman-node-modules`/`codeman-dist` build-artefact volumes when it detects
+the checkout's HEAD or `package-lock.json` moved — exactly right for an
+ordinary `git pull`, too narrow when a release note (or the updater's own
+blocker message) calls for starting over on a Dockerfile-only change, which
+touches neither. For that case, `docker/Update-Codeman.sh` force-rebuilds the
+image with no layer cache, clears those two volumes, stops the stack, then
+hands off to `Start-Codeman.sh` for the usual start:
 
 ```sh
 bash docker/Update-Codeman.sh
 ```
 
-Add `--volumes` to also clear the `codeman-node-modules`/`codeman-dist`
-volumes — the scripted form of "Resetting the build artefacts" in
+Pass `--keep-volumes` to skip clearing them (safe only if you know the
+rebuilt image's `node_modules`/`dist` did not change) — the scripted default
+is the "Resetting the build artefacts" procedure in
 [`../docs/docker-self-update.md`](../docs/docker-self-update.md). Those two
-are the only named volumes this stack declares; application data and case
-workspaces are host bind mounts and are never touched either way.
+are the only named volumes `docker-compose.yaml` itself declares; a
+`docker-compose.override.yml` could add more, and application data and case
+workspaces are host bind mounts, never touched either way.
 
 ## Local customisation