Every real caller (code.aneur.in/cloud/cloud's deploy workflows) runs a
mounted-in script against pass-cli, not bare pass-cli args, so an
ENTRYPOINT override was needed on every invocation. With no ENTRYPOINT,
`docker run this-image sh /script.sh` just replaces CMD directly.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Prebuilt glibc image for pass-cli, so Alpine/musl-based CI jobs (e.g.
harmless-easy-bobcat's docker:cli-based deploy workflows) can pull and run
it without hitting missing glibc symbols.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>