feat(entry-point): add secret runtime input type and fix nonroot container volumes

[LuD1161]

Summary

• Add secret type to entry point runtime inputs (renders as password field in UI)
• Fix IsolatedContainerVolume permissions for nonroot containers (distroless images)
• Update documentation for both features

Changes

• Entry Point Secret Inputs: Added 'secret' to runtime input types across worker, backend, and frontend. Secret inputs render as masked password fields in the RunWorkflowDialog.
• Nonroot Container Support: Added setVolumePermissions() to IsolatedContainerVolume that sets chmod 777 on volume directories, allowing distroless nonroot containers (uid 65532) to write output files.
• Documentation: Updated component-development.mdx with Entry Point Runtime Input Types section, isolated-volumes.mdx with Nonroot Container Support section, and SKILL.md quick reference.

Test plan

• Verify secret runtime inputs render as password fields in workflow trigger dialog
• Verify secret values flow through entry point to downstream components
• Test Docker components using distroless nonroot images can write output files
• Run unit tests: bun --cwd worker test

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

studio/worker/src/components/core/entry-point.ts

Lines 127 to 128 in c1dbcc9

	outputs[inputDef.id] = value;
	context.logger.info(`[EntryPoint] Output '${inputDef.id}' = ${typeof value === 'object' ? JSON.stringify(value) : value}`);

Avoid logging secret runtime input values

The loop logs each runtime input value verbatim; when the new secret type is used, this will emit the secret into worker logs whenever a workflow is triggered. That defeats the intent of masking in the UI and can leak credentials to log sinks (e.g., Loki). Consider skipping logging for secret inputs or redacting the value before logging.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".