fix(docker): align Dockerfile with current ARC base image (mambauser)

[alongd]

Problem

The Docker image build (docker_build.yml → ci-check) fails at the git clone step with:

unable to find user rmguser: no matching entries in passwd file

Root cause: the base image laxzal/arc:latest was rebuilt on the modern ARC image (mambaorg/micromamba, Ubuntu 24.04), which uses the mambauser account and /home/mambauser home. The old rmguser / /home/rmguser account this Dockerfile assumed no longer exists, so USER rmguser can't resolve. The Dockerfile had also gone stale since 2024 — it referenced Python 3.7 site-packages cleanup paths (T3 is now Python 3.14) and the base image's old entrypoint path.

This is pre-existing and independent of the GitHub Actions bumps in #173 — that PR's ci-check failure is this same bug (it only surfaced there because docker_build.yml runs on changes to workflow/Dockerfile paths).

Changes

• USER rmguser → mambauser; /home/rmguser/* → /home/mambauser/* throughout.
• Inherit the base image's entrypoint (/usr/local/bin/entrywrapper.sh, which starts as root and runusers to mambauser) instead of hard-coding the removed /home/rmguser/entrywrapper.sh; end on USER root so the entrypoint can drop privileges itself.
• Replace the hard-coded python3.7 per-package find … tests cleanups with cleanups scoped to paths that always exist, so a missing path can't break the && chain.
• Document the inherited base-image contract at the top of the file.

Verification

The docker_build.yml ci-check job (docker build, no push) runs on this PR and is the verification gate. Base-image contract (mambauser, /home/mambauser, /usr/local/bin/entrywrapper.sh) was derived from the current ReactionMechanismGenerator/ARC Dockerfile, which laxzal/arc:latest tracks.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Aligns the project Docker build with the current laxzal/arc:latest (modern ARC/micromamba) base-image contract by switching to the mambauser account layout and relying on the base entrypoint, fixing the CI docker build failure caused by the removed rmguser.

Changes:

• Switch Dockerfile user/home paths from rmguser (/home/rmguser) to mambauser (/home/mambauser) and update working directories accordingly.
• Stop hard-coding the legacy entrypoint; rely on the base image’s /usr/local/bin/entrywrapper.sh and finish as USER root so it can drop privileges itself.
• Simplify image “slimming” cleanup steps to avoid brittle, version-specific site-packages paths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.69%. Comparing base (f388d3d) to head (b0e1034).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #175   +/-   ##
=======================================
  Coverage   72.69%   72.69%           
=======================================
  Files          37       37           
  Lines        5929     5929           
  Branches     1289     1289           
=======================================
  Hits         4310     4310           
  Misses       1172     1172           
  Partials      447      447           

Flag	Coverage Δ
unittests	72.69% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.