chore: run Docker runtime as non-root user

[crazywriter1]

Summary

Closes #2492.

Runtime images currently start as root. This adds an unprivileged miden user (uid/gid 10001) and sets USER miden on runtime-common, so runtime and runtime-tool inherit it.

/data is created and owned by that user in the image so a first-use named volume mounted at /data inherits the ownership. Without that, Docker creates the volume as root:root and the process cannot write. Builder stages, COPY, and CMD are unchanged.

Existing volumes that were written as root need chown -R 10001:10001 or to be recreated. New volumes are unaffected. If maintainers want an automatic migration for those volumes, I can add it as a follow-up.

Changelog

[[entry]]
scope       = "node"
impact      = "changed"
description = "Docker runtime images now run as a non-root `miden` user (uid 10001)."

[crazywriter1]

The changelog check failed because the toml fence in the PR description was not closed (the inner closing backticks were eaten on paste). I’ll close that fence in the description, no code change. @sergerad @kkovaacs