Seed writable Pi runtime config in Docker

Dockerfile

@@ -12,10 +12,14 @@ COPY shared ./shared
 COPY db/migrations ./db/migrations
 COPY scripts ./scripts
 RUN node scripts/stamp-asset-version.mjs
+COPY docker-entrypoint.sh /usr/local/bin/roast-command-center-entrypoint
+RUN chmod 755 /usr/local/bin/roast-command-center-entrypoint
 
-# The optional Pi agent configuration is mounted read-only here at runtime.
+# The optional Pi agent configuration is mounted read-only at /run and copied to this writable
+# runtime directory by the entrypoint; Pi's auth storage needs a sibling lock file.
 ENV HOME=/home/node
 RUN mkdir -p /home/node/.pi/agent && chown -R node:node /home/node/.pi
 USER node
 EXPOSE 8090
+ENTRYPOINT ["roast-command-center-entrypoint"]
 CMD ["node", "server/index.js"]