RD-3960 add opt-in init: true skipper.yaml field for PID-1 reaping

[simba1997]

Summary

`skipper-entrypoint.sh` runs the user command via `bash -c "$@"` with no `exec`, so bash stays PID-1 inside the build container. Bash as PID-1 does not forward SIGTERM and does not reap orphaned children. When the container is stopped (Jenkins pipeline cancellation, manual `docker stop`, etc.), SIGTERM is swallowed and long-running children survive as host-visible zombies.

Add a new opt-in `init` config field to `skipper.yaml`. When set to `true`, `--init` is added to `docker/podman run` so a real init (tini on docker, catatonit on podman) runs as PID-1.

Default is `false` — existing consumers see no behaviour change. This addresses the concern that an always-on `--init` could break consumers whose workflows depend on the current no-init semantics (custom init systems, daemon-spawning patterns, tests that assert PID-1 == specific binary).

Reproduction

Debian container, bash entrypoint mimicking `skipper-entrypoint.sh` (`bash -c "$@"`, no `exec`):

Setup	`docker stop -t 5`
Default (bash PID-1)	6s — SIGTERM ignored, SIGKILL after grace
`--init`	0s — SIGTERM forwarded cleanly

Usage

In a consumer's `skipper.yaml`:

```yaml
registry: my.registry:5000
build-container-image: my-build-image
init: true # opt in to PID-1 reaping
```

Changes

• `skipper/cli.py`: read `init` from config defaults, thread through three `runner.run` callsites.
• `skipper/runner.py`: accept `init` kwarg, add `--init` to docker args when true.
• `tests/test_cli.py`: new `SKIPPER_CONF_WITH_INIT` fixture + assertion that `init=True` flows through. Updated 28 existing `assert_called_once_with` blocks with `init=False`.
• `tests/test_runner.py`: new positive/negative tests that `--init` is/isn't in the docker argv.

Relation to #191

This PR is orthogonal to #191 (entrypoint override). Both are config-file additions that opt-in fix the orphan-on-cancel bug:

• `init: true` (this PR) — uses Docker's built-in tini, no consumer image changes
• `entrypoint:` (support changing entrypoint in skipper #191) — consumer wraps their entrypoint with dumb-init in their image

For the rootfs-star RC pipeline (RD-3960), `init: true` is the simpler fix: no Dockerfile changes, no apt-installed dumb-init, no wrapper script.

Test plan

• Unit tests pass (CI).
• Manual: skipper.yaml without `init` key → `docker exec ... ps -ef` shows PID-1 = user entrypoint (unchanged behaviour).
• Manual: skipper.yaml with `init: true` → PID-1 = `docker-init`. `docker stop` terminates cleanly.

🤖 Generated with Claude Code