feat(paseo)!: drop go and sdkman, rename AGENT_CLIS to AGENTS

The image installs python, gh, glab, build-essential, sudo, zsh and nano
only; go or a jvm goes into $HOME from a terminal instead.

SHELL and TZ are written into compose.yml rather than read from .env, so
the deploying shell's own values can no longer win over them.

The entrypoint calls chpasswd, chown and gosu by absolute path, tolerates
a chpasswd failure instead of taking the start down with it, turns
globbing off around the agent loop, and counts an agent as installed only
when its binary actually runs.

paseo/entrypoint.sh

@@ -1,11 +1,16 @@
 #!/usr/bin/env bash
 # Runs as root ahead of the image's own entrypoint: sets the paseo user's
-# login password, installs SDKMAN, then installs any agent CLI named in
-# AGENT_CLIS that is not already on PATH. See README.md.
+# login password, then installs any agent CLI named in AGENTS whose command
+# does not already run. See README.md.
 set -euo pipefail
 
-if [[ "$(id -u)" == "0" && -n "${PASEO_PASSWORD:-}" ]]; then
-  printf 'paseo:%s\n' "$PASEO_PASSWORD" | chpasswd
+if [[ "$(id -u)" != "0" ]]; then
+  exec /usr/local/bin/paseo-docker-entrypoint "$@"
+fi
+
+if [[ -n "${PASEO_PASSWORD:-}" ]]; then
+  printf 'paseo:%s\n' "$PASEO_PASSWORD" | /usr/sbin/chpasswd \
+    || echo "entrypoint: could not set the paseo password, continuing" >&2
 fi
 
 agent_installer() {
@@ -19,33 +24,33 @@ agent_installer() {
   esac
 }
 
-if [[ "$(id -u)" == "0" ]]; then
-  chown paseo:paseo /home/paseo
+/usr/bin/chown paseo:paseo /home/paseo
 
-  if [[ ! -d "${SDKMAN_DIR:-/home/paseo/.sdkman}" ]]; then
-    echo "entrypoint: installing sdkman"
-    gosu paseo bash -c 'curl -fsSL https://get.sdkman.io | bash' \
-      || echo "entrypoint: sdkman failed to install, continuing" >&2
+agents="${AGENTS:-}"
+
+set -f
+
+for agent in ${agents//,/ }; do
+  installer="$(agent_installer "$agent")"
+
+  if [[ -z "$installer" ]]; then
+    echo "entrypoint: no such agent CLI: $agent" >&2
+    continue
   fi
 
-  agents="${AGENT_CLIS:-}"
+  # 126 and 127 are the shell's own codes for a binary that is missing or
+  # cannot be executed; any other code means it ran.
+  rc=0
+  /usr/sbin/gosu paseo bash -c '"$0" --version' "$agent" >/dev/null 2>&1 \
+    || rc=$?
 
-  for agent in ${agents//,/ }; do
-    installer="$(agent_installer "$agent")"
+  if (( rc != 126 && rc != 127 )); then
+    continue
+  fi
 
-    if [[ -z "$installer" ]]; then
-      echo "entrypoint: no such agent CLI: $agent" >&2
-      continue
-    fi
-
-    if command -v "$agent" >/dev/null 2>&1; then
-      continue
-    fi
-
-    echo "entrypoint: installing $agent"
-    gosu paseo bash -c "$installer" \
-      || echo "entrypoint: $agent failed to install, continuing" >&2
-  done
-fi
+  echo "entrypoint: installing $agent"
+  /usr/sbin/gosu paseo bash -c "$installer" \
+    || echo "entrypoint: $agent failed to install, continuing" >&2
+done
 
 exec /usr/local/bin/paseo-docker-entrypoint "$@"