Resolve HOME to the target user's home directory instead of /root

ResolvedUser now carries home, looked up from the image's own
/etc/passwd entry for the final resolved uid (falling back to /root
for uid 0 or / otherwise when there's no matching row). bwrap's HOME
now uses this whenever a user override applies (--user/--group or an
image-declared default user); the plain /root default is kept only
when no override applies at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Gv3s5jckJKzh6JkMoi2Akz

CLAUDE.md

@@ -115,11 +115,17 @@ Source layout (all under `src/`):
   a name or numeric id) against the *mounted image's own* `/etc/passwd`/`/etc/group`
   (not the host's), since names like `git` only mean anything inside that image's own
   user database. A numeric user with no group and no matching `/etc/passwd` entry
-  defaults gid to the same numeric value as the uid. `run_container()` (`main.cpp`)
-  calls this with either the explicit `--user`/`--group` flags, or, when `--user`
-  wasn't given, the image's own declared `config.User` (`OciImageConfig::user`/
-  `group`) — so a container defaults to running as whatever user the image itself
-  declares, not root, unless the image declares none.
+  defaults gid to the same numeric value as the uid. `ResolvedUser` (`bwrap.h`) also
+  carries `home`, looked up by the final resolved uid's `/etc/passwd` entry (field 5)
+  regardless of whether `user` was given as a name or a number; falls back to
+  `"/root"` for uid 0 or `"/"` otherwise when there's no matching row.
+  `build_bwrap_args()` (`bwrap.cpp`) sets the sandboxed process's `HOME` from this —
+  `"/root"` only when no user override applies at all (no `--user`, no image-declared
+  `config.User`). `run_container()` (`main.cpp`) calls `resolve_user_and_group()`
+  with either the explicit `--user`/`--group` flags, or, when `--user` wasn't given,
+  the image's own declared `config.User` (`OciImageConfig::user`/`group`) — so a
+  container defaults to running as whatever user the image itself declares, not
+  root, unless the image declares none.
 - `process.{h,cpp}` — argv-based subprocess helpers (fork/execvp, no shell):
   `run_process()` captures stdout (used for `containers-storage` calls),
   `run_process_foreground()` inherits all of stdio (used for the interactive `bwrap`