Install sled binary in huskies-owned dir so upgrades work without root

/opt/huskies/bin/huskies (chowned to the huskies user) with a symlink
from /usr/local/bin/huskies. Atomic replace needs write permission on
the directory for the tmp-write + rename, which root-owned
/usr/local/bin can't provide to the server process.

resolve_target_path() now prefers /opt/huskies/bin/huskies over
current_exe(), which can point at a stale location (e.g.
/workspace/target/release/huskies after a historical in-container
rebuild) that the entrypoint would never launch after a restart.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019fHdm92yjvguPi2LiXfLB9

docker/Dockerfile.base

@@ -33,7 +33,12 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # Copy the huskies binary and entrypoint from the main image.
-COPY --from=huskies-src /usr/local/bin/huskies /usr/local/bin/huskies
+# The binary lives in /opt/huskies/bin (chowned to the huskies user below) so
+# the in-process upgrade path (`POST /api/upgrade`) can atomically replace it
+# without root: rename() needs write permission on the *directory*, not just
+# the file. /usr/local/bin/huskies stays a symlink so PATH resolution and the
+# entrypoint CMD are unchanged.
+COPY --from=huskies-src /usr/local/bin/huskies /opt/huskies/bin/huskies
 COPY --from=huskies-src /usr/local/bin/entrypoint.sh /usr/local/bin/entrypoint.sh
 
 # Non-root user — Claude Code refuses --dangerously-skip-permissions as root.
@@ -44,6 +49,8 @@ RUN groupadd -r huskies \
     && mkdir -p /home/huskies/.ssh \
     && chmod 700 /home/huskies/.ssh \
     && chown -R huskies:huskies /home/huskies \
+    && chown -R huskies:huskies /opt/huskies \
+    && ln -s /opt/huskies/bin/huskies /usr/local/bin/huskies \
     && mkdir -p /workspace \
     && chown huskies:huskies /workspace \
     && git config --global init.defaultBranch master \