Summary

Two follow-ups from the #1279 container-lifecycle rework (#1282):

• Docker image PID 1 (entrypoint.sh) doesn't reap reparented zombies #1287 — reap orphaned subprocesses. Insert tini as PID 1 via the
  ENTRYPOINT. entrypoint.sh supervises netclawd with netclawd & wait $PID, so it only reaps its own direct child. netclawd's tool subprocesses
  that orphan (their parent exits) reparent to PID 1 and, with entrypoint.sh
  as PID 1, were never reaped — they piled up as <defunct> zombies over a
  long-running container's lifetime. tini is the canonical tiny init that
  reaps them; -g forwards signals to the whole process group so docker stop
  reaches netclawd even mid-backoff.

• Dedup container smoke test bring-up/health-poll with validate_docker_image.yml #1303 — dedup the Docker smoke setup. The minimal-provider env contract
  (NETCLAW_Providers__validate__* / NETCLAW_Models__Main__*) and the
  /api/health/ready poll were copy-pasted across the two
  validate_docker_image.yml verify steps and test-daemon-lifecycle.sh.
  Extracted them into scripts/docker/lib/smoke-lib.sh so the port, health
  path, provider-env contract, and crash-bail logic live in one place and
  can't silently drift.

Changes

• docker/Dockerfile: add tini to the apt set; ENTRYPOINT ["/usr/bin/tini", "-g", "--", "/opt/netclaw/entrypoint.sh"]; update the header comments to
  describe the tini → entrypoint.sh → netclawd tree.
• scripts/docker/lib/smoke-lib.sh (new): netclaw_smoke_env_args and
  netclaw_wait_healthy (0 healthy / 1 timeout / 2 exited).
• scripts/docker/test-daemon-lifecycle.sh: source the lib; add Phase D
  (orphan reaping — spawn a process that reparents to PID 1, kill it, assert it
  is reaped not left <defunct>); replace the bare PPID == 1 supervision
  assertion with a chain check (netclawd → entrypoint.sh → PID 1) that
  still expresses "supervised, not a detached exec-session daemon" now that
  tini, not entrypoint.sh, is PID 1.
• .github/workflows/validate_docker_image.yml: both verify steps source the
  lib; broaden the path filter to scripts/docker/** so a change to the shared
  lib re-runs the image gate.

Validation

Built the image locally and ran the full lifecycle smoke test — all four
phases pass:

initial: count=1 pid=21 supervision=ok (port :5199)
Phase A: config write re-binds :5199 -> :5200 in-process (same pid, supervision ok)
Phase B: 'netclaw daemon start' defers — "Daemon managed by container supervisor (PID 21)"
Phase C: bad Daemon config fails loud (supervisor observes exit) + recovers
Phase D: orphan pid 346 reaped by PID 1 (tini)

The same validate_docker_image workflow runs this on the PR (it touches
docker/** and scripts/docker/**).

Closes #1287
Closes #1303