Release docker changes

[ClePol]

Summary

This PR adds support for building Docker images from the pinned, backend-neutral requirements.txt instead of always
resolving dependencies from pyproject.toml.

It also updates the generated requirements.txt from the tested release apptainer image and introduces an error message when users forget to map their host UID/GID into the Docker container instead of a crash.

Changes

• Add tools/export_pip-r.sh support for exporting backend-neutral pinned requirements from Docker or Singularity/
  Apptainer images.
• Regenerate requirements.txt from fastsurfer-dev-3c52a21.sif.
• Add tools/Docker/build.py --pinned_requirements.
• Pass PINNED_REQUIREMENTS=true into the Dockerfile and install via uv pip compile --torch-backend=<device> requirements.txt.
• Keep CUDA/backend wheel selection separate from the pinned shared dependency set.
• Include root requirements.txt in the Docker build context despite the broader .dockerignore requirements pattern.
• Create a real default nonroot user in the Docker image.
• Reject runs as the default Docker nonroot user with a message asking users to pass -u $(id -u):$(id -g).
• Keep existing root protection and --allow_root behavior.

Testing

• Built Docker with --pinned_requirements.
• Verified image metadata and default user.
• Verified default unmapped Docker run exits with the new -u $(id -u):$(id -g) message.
• Verified root run exits with the existing root guard.
• Verified root with --allow_root warns and continues.
• Verified mapped host user run works and reaches the expected license check.
• Verified long_fastsurfer.sh also triggers the new default nonroot guard.
• Verified Python CUDA stack: torch 2.7.1+cu118, torchvision 0.22.1+cu118, CUDA 11.8.
• Verified --pinned_requirements --dry_run emits PINNED_REQUIREMENTS=true for another CUDA backend.

[Copilot]

Pull request overview

This PR updates the Docker/Apptainer build and release workflow to support building images from a backend-neutral, pinned requirements.txt (while still selecting the PyTorch backend at build time), and improves the runtime UX by detecting missing Docker --user mapping instead of crashing.

Changes:

• Extend tools/export_pip-r.sh to export backend-neutral pinned requirements from Docker or Singularity/Apptainer images (filtering backend-specific packages).
• Add --pinned_requirements to the Docker build script and wire it through the Dockerfile to install from requirements.txt when enabled.
• Introduce a default nonroot image user and add a guard that exits with a helpful message when users forget -u $(id -u):$(id -g).

Reviewed changes

Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/export_pip-r.sh	Adds Apptainer support, tmp-file output, and filtering to generate backend-neutral pinned requirements.
tools/Docker/README.md	Documents the required --user mapping behavior and the new --pinned_requirements build option.
tools/Docker/Dockerfile	Adds a pinned-requirements install path, includes requirements in the build stage, and creates a real nonroot user.
tools/Docker/build.py	Adds --pinned_requirements and passes PINNED_REQUIREMENTS build arg; minor builder selection logic tweak.
run_fastsurfer.sh	Updates comment to reflect expanded docker/root user validation.
requirements.txt	Regenerated pinned dependency set intended for backend-neutral installs.
recon_surf/functions.sh	Extends check_allow_root to also detect missing Docker --user mapping via default-user guard.
long_fastsurfer.sh	Updates comment to reflect expanded docker/root user validation.
.dockerignore	Re-includes root requirements.txt in Docker build context while keeping broader ignore patterns.

Comments suppressed due to low confidence (1)

tools/export_pip-r.sh:123

• If the final mv fails, the script still clears the EXIT trap (trap - EXIT), which can leave the temporary file behind and silently continue with a stale $target. Consider checking mv's exit status and only disabling the trap after a successful rename (or keep the trap and exit 1 on failure).

} >> "$tmp_target"

mv "$tmp_target" "$target"
trap - EXIT

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.