fix(agents): make baked payload readable

[elezar]

Summary

Make the immutable agent payload readable and executable by the non-root sandbox user after it is copied into generated sandbox images.

Related Issue

None.

Changes

• Add a generated Dockerfile permission step that applies chmod -R a+rX to /etc/openshell/agent-payload before removing write bits.
• Preserve the existing immutable payload behavior with the following chmod -R a-w step.

Testing

• bash -n scripts/agents/run.sh passes
• bash scripts/agents/runtime/supervisor_test.sh passes
• bash scripts/agents/gator/bin/gh_guard_test.sh passes
• Live gator launch for PR refactor(compute): make sandbox readiness gateway-owned across all drivers #2153 reached sandbox Ready and started watch cycle 1
• mise run pre-commit passes (skipped at operator request)
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)