Fix the doctor's invocation path; assert the boot log in CI

The entrypoint called /usr/local/bin/dsh-workspace-doctor while the
Dockerfile installs /usr/local/bin/dsh-workspace-doctor.mjs, so every
start logged "...: not found" and the workspace doctor never ran: no
report, no repair. The CI smoke test checked the .mjs path with a direct
`docker exec`, which cannot see a mistake in the entrypoint's own
invocation, so the build stayed green while the container was broken.

Resolve the doctor by name (`command -v dsh-workspace-doctor.mjs`) in
both the root and the non-root path, and log an explicit "not installed
in this image" line when it cannot be found, instead of the shell's bare
"not found". The smoke test now reads the container's boot log: it
requires the doctor's own "dsh-workspace-doctor:" output to appear, and
fails if the entrypoint logs its "workspace doctor:" failure line — that
covers path, exec bit and invocation together, which is the class of
mistake that shipped.

README: manual repair through a one-off container with --entrypoint (dsh
stopped, so nothing races the registry write), and the note that an
existing Unraid container does not pick up the template's new Workspace
Doctor variable on its own.

docker-entrypoint.sh

@@ -137,17 +137,33 @@ if [ "$(id -u)" = 0 ]; then
     # recreate the directories and re-account the orphaned sessions when asked
     # (backup first, session logs never touched). See README:
     # "Chats land in Ungrouped after an update".
+    #
+    # Resolve it by name: the installed file is dsh-workspace-doctor.mjs, and a
+    # path spelled out here is exactly how a "not found" reaches production. The
+    # CI smoke test asserts this step's output appears in the boot log, so a
+    # rename or a wrong spelling fails the build instead of the container start.
+    DOCTOR="$(command -v dsh-workspace-doctor.mjs 2>/dev/null || true)"
     case "${DSH_WORKSPACE_DOCTOR:-warn}" in
         0|off|no) ;;
         repair|all|1|yes)
-            /usr/local/bin/dsh-workspace-doctor --all \
-                || log "workspace doctor: repair did not finish; starting dsh with the registry unchanged"
-            # The doctor runs as root here; hand what it wrote back to the runtime user.
-            chown "$PUID:$PGID" "$STATE/storages/workspace.json" "$STATE/storages/"workspace.json.bak-* 2>/dev/null || true
+            if [ -n "$DOCTOR" ]; then
+                "$DOCTOR" --all \
+                    || log "workspace doctor: repair did not finish; starting dsh with the registry unchanged"
+                # The doctor runs as root here; hand what it wrote back to the runtime user.
+                chown "$PUID:$PGID" "$STATE/storages/workspace.json" "$STATE/storages/"workspace.json.bak-* 2>/dev/null || true
+            else
+                log "workspace doctor: dsh-workspace-doctor.mjs is not installed in this image;"
+                log "      workspace grouping was NOT repaired. Update the image."
+            fi
             ;;
         *)
-            /usr/local/bin/dsh-workspace-doctor --check \
-                || log "workspace doctor: see the report above - set DSH_WORKSPACE_DOCTOR=repair to fix it at startup"
+            if [ -n "$DOCTOR" ]; then
+                "$DOCTOR" --check \
+                    || log "workspace doctor: see the report above - set DSH_WORKSPACE_DOCTOR=repair to fix it at startup"
+            else
+                log "workspace doctor: dsh-workspace-doctor.mjs is not installed in this image;"
+                log "      workspace grouping was NOT checked. Update the image."
+            fi
             ;;
     esac
 
@@ -163,6 +179,9 @@ if [ ! -w "$STATE" ]; then
     log "      chown -R $(id -u):$(id -g) <host path mounted at $STATE>"
     exit 1
 fi
-/usr/local/bin/dsh-workspace-doctor --check \
-    || log "workspace doctor: see the report above (running unprivileged, so it only reports)"
+DOCTOR="$(command -v dsh-workspace-doctor.mjs 2>/dev/null || true)"
+if [ -n "$DOCTOR" ]; then
+    "$DOCTOR" --check \
+        || log "workspace doctor: see the report above (running unprivileged, so it only reports)"
+fi
 exec dsh "$@"