Fix onboard smoke Docker flow for clean npx runs

Dockerfile.onboard-smoke

@@ -2,17 +2,22 @@ FROM ubuntu:24.04
 
 ARG NODE_MAJOR=20
 ARG PAPERCLIPAI_VERSION=latest
+ARG HOST_UID=10001
 
 ENV DEBIAN_FRONTEND=noninteractive \
   PAPERCLIP_HOME=/paperclip \
   PAPERCLIP_OPEN_ON_LISTEN=false \
   HOST=0.0.0.0 \
   PORT=3100 \
+  HOME=/home/paperclip \
+  LANG=en_US.UTF-8 \
+  LC_ALL=en_US.UTF-8 \
+  NPM_CONFIG_UPDATE_NOTIFIER=false \
   NODE_MAJOR=${NODE_MAJOR} \
   PAPERCLIPAI_VERSION=${PAPERCLIPAI_VERSION}
 
 RUN apt-get update \
-  && apt-get install -y --no-install-recommends ca-certificates curl gnupg \
+  && apt-get install -y --no-install-recommends ca-certificates curl gnupg locales \
   && mkdir -p /etc/apt/keyrings \
   && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key \
     | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
@@ -20,10 +25,16 @@ RUN apt-get update \
     > /etc/apt/sources.list.d/nodesource.list \
   && apt-get update \
   && apt-get install -y --no-install-recommends nodejs \
+  && locale-gen en_US.UTF-8 \
+  && groupadd --gid 10001 paperclip \
+  && useradd --create-home --shell /bin/bash --uid "${HOST_UID}" --gid 10001 paperclip \
+  && mkdir -p /paperclip /home/paperclip/workspace \
+  && chown -R paperclip:paperclip /paperclip /home/paperclip \
   && rm -rf /var/lib/apt/lists/*
 
 VOLUME ["/paperclip"]
-WORKDIR /workspace
+WORKDIR /home/paperclip/workspace
 EXPOSE 3100
+USER paperclip
 
 CMD ["bash", "-lc", "set -euo pipefail; mkdir -p \"$PAPERCLIP_HOME\"; npx --yes \"paperclipai@${PAPERCLIPAI_VERSION}\" onboard --yes --data-dir \"$PAPERCLIP_HOME\""]