fix(agent-bot): run as non-root bun user (#42)

Drop root in the container so a compromised process cannot own the
whole container filesystem (CWE-250). Files copied with --chown=bun:bun
and /app is chowned before the USER switch so bun install still writes
node_modules.

Closes #39