[Hermsi1337]

Closes #2190

Stacked on #2189 (the entrypoint changes there), so the base is feat/docker-host-uid.

• install tini and use tini -s -g -- /usr/local/bin/mw-entrypoint as entrypoint. -g sends signals to the whole process group, so node behind the bash launcher (and e.g. the ssh child of port-forward) gets them. -s registers tini as subreaper, so docker run --init keeps working without tini's "not running as PID 1" warning on stderr
• CI: docker stop must end the CLI with exit code 143 (SIGTERM) in root and MW_UID mode. The uid check now looks at the node process via docker top, since PID 1 is tini now

Tested on arm64 with an image from this branch and the v1.28.1 tarball:

	docker stop -t 10	exit code
v1.28.1 / without tini	10.2s	137
this branch	0.2s	143
this branch with --init	0.2s	143, stderr empty

Also checked: docker kill -s INT gives 130, Ctrl-C in an interactive -it run (with MW_UID) ends in 0.3s, exit codes propagate (unknown command gives 1), project list -o json piping still gives clean JSON as root and with MW_UID=1000, and all CI docker steps pass as separate bash -e shells. The new stop check fails (137) against the same image without tini.

After review: the entrypoint uses the absolute /usr/bin/tini, the stop check waits until node is running instead of a fixed sleep (otherwise SIGTERM could hit the entrypoint shell and pass without testing anything), uses --time 10 and cleans up via trap, and a new step checks that docker run --init keeps stderr empty. Both checks fail against an image without tini resp. without -s.