fix: resolve 17 bugs found during comprehensive code review

[SimplicityGuy]

Summary

Comprehensive bug review identified and fixes 17 issues across entrypoint.sh, Dockerfile, CI/CD workflows, and config samples.

Critical fixes

• CRONTAB_FILE resolved before HOME_DIR — crontab written to /crontab instead of ${HOME_DIR}/crontab
• jq pipeline crashes on array-format configs — to_entries assumes object input; array configs (documented format) caused script exit
• @every schedule silently dropped — BusyBox crond doesn't support @every; jobs never ran. Now errors clearly, samples updated to */2 * * * *
• update-project.yml never creates PRs — grep pattern didn't match Dockerfile, detection logic was inverted

Important fixes

• Container leak: docker run missing --rm, stopped containers accumulate indefinitely
• crond log level inverted: -d 7 is nearly silent, not max debug; changed to -d 0
• ARM binary compatibility: glibc-linked rq binaries fail on Alpine musl; added gcompat
• LABEL created: Was literal $(date ...) string, now uses BUILD_DATE build-arg
• DOCKER_PORT_2375_TCP check: [ -a ] tests file existence, not variable non-emptiness
• COMMENT injection: Newlines in comment field could inject crontab entries
• Slug collision: Duplicate slugs silently overwrote job scripts
• Non-atomic script writes: Scripts now built in temp file, then mv'd into place
• Onstart error tracking: Background jobs now tracked with wait + exit status warning
• DOCKER_GID validation: Now rejects non-numeric values
• Schedule escaping: Removed unnecessary \* escape/unescape round-trip
• IFS scoped locally: Global IFS set moved to read command scope
• Config samples: Fixed corrupted TOML key, wrong volume mount, EOL alpine:3.5

Test plan

• Build Docker image successfully on amd64: docker build -t crontab .
• Build Docker image on arm64 (verify gcompat resolves rq binary issue)
• Test with array-format JSON config (config.sample.json)
• Test with mapping-format JSON config (config.sample.mapping.json)
• Test with TOML config (config.sample.toml)
• Verify @every schedule produces clear error message
• Verify generated crontab file is written to correct ${HOME_DIR}/crontab path
• Verify --rm is present in generated docker run commands
• Verify crond output is verbose (log level 0)
• Verify docker inspect labels show BUILD_DATE value
• Run update-project workflow manually to verify base image detection

🤖 Generated with Claude Code