fix: lfx boot, deploy key, and entrypoint perms for compose/devcontainer

frontend/Dockerfile

@@ -5,9 +5,13 @@ FROM node:22-slim
 
 WORKDIR /srv/kirche-einfach/frontend
 COPY package.json package-lock.json entrypoint.sh ./
-RUN npm ci && chmod +x entrypoint.sh
+RUN npm ci
 COPY . ./
+RUN chmod +x entrypoint.sh
 
 EXPOSE 3000
 
-ENTRYPOINT ["./entrypoint.sh"]
+# Explicit `sh`: the repo bind-mount shadows the image at runtime, and git
+# tracks entrypoint.sh as 100644 — relying on the exec bit breaks Windows
+# checkouts (and fresh Linux clones). `sh script` needs read-only.
+ENTRYPOINT ["sh", "./entrypoint.sh"]