packaging: upgrade commit must not bake the upgrader's runtime config

docker commit snapshots the container's RUNTIME config, so the upgrade flow's
--entrypoint coderai-upgrade override and -e CODERAI_UPGRADE_* vars were being
committed into the image — leaving coderai:base with the upgrader as its default
ENTRYPOINT, so the server "failed to start" (every new container ran the upgrade
script, which as --user also dies on the root-owned app tree). Capture the
image's original ENTRYPOINT/CMD before the upgrade run and re-apply them via
docker commit --change, and blank the injected env vars.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPLnsRpNBzWCHLgkXATqRz