fix(docker): restore capabilities for privilege drop

.github/workflows/ci.yml

@@ -189,6 +189,11 @@ jobs:
       - name: Build image with default channel dependencies
         run: docker build -t nanobot:test .
 
+      - name: Verify Docker Compose startup
+        env:
+          HOME: ${{ runner.temp }}
+        run: docker compose run --rm --no-deps --build -T nanobot-cli status
+
       - name: Verify default WhatsApp dependencies
         run: docker run --rm --entrypoint python nanobot:test -c "import neonize, segno"
 

docker-compose.yml

@@ -8,6 +8,11 @@ x-common-config: &common-config
     - ~/.nanobot:/home/nanobot/.nanobot
   cap_drop:
     - ALL
+  # Entrypoint uses these to fix bind-mount ownership and drop to the nanobot user.
+  cap_add:
+    - CHOWN
+    - SETGID
+    - SETUID
 
 services:
   nanobot-gateway: