fix(docker): support non-root base image

[sagic-orca]

Summary

The ghcr.io/orcasecurity/orca-cli:1 base image now sets USER orca (non-root) at the end of its build. This caused RUN apk add in downstream Dockerfiles to fail with permission denied.

• Add USER root immediately after the FROM line so apk has the required permissions during the build stage.
• Add USER orca just before the ENTRYPOINT to drop back to the non-root user at runtime, preserving runtime security posture.

Test plan

• Build the Docker image locally and verify apk add bash succeeds without permission errors.
• Run the container and confirm the entrypoint executes as the orca (non-root) user.
• Verify CI pipeline builds and passes successfully.

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	OSS Licenses	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca