feat: AtroPIM image pipeline with secret-free build (AZ-NIX-ava.1)

- flake input atrocore-docker rev-pinned (e1e9bed)
- pkgs/atropim-image: atropim-build/atropim-push scripts + 2-stage
  podman build (vendor pdf target + entrypoint wrapper)
- entrypoint writes ATRO_DB_* to data/config.php at runtime,
  guarded by isInstalled (idempotent); no DB credentials in layers
- devShell documents build/push commands and ENV variables

pkgs/atropim-image/entrypoint/entrypoint-prepare-pim.php

@@ -0,0 +1,32 @@
+<?php
+/* Runtime counterpart of the vendor's prepare-pim.php (atrocore/docker). */
+
+if (empty($argv[5])) {
+    exit("Usage: php entrypoint-prepare-pim.php <instance-dir> <db-host> <db-name> <db-user> <db-password>\n");
+}
+
+$instanceDir = $argv[1];
+
+chdir($instanceDir);
+set_include_path($instanceDir);
+
+require_once 'vendor/autoload.php';
+
+$app = new \Atro\Core\Application();
+$config = $app->getContainer()->get('config');
+
+if ($config->get('isInstalled')) {
+    exit("[entrypoint] instance already installed - keeping existing data/config.php\n");
+}
+
+$config->set('database', [
+    'driver' => 'pdo_pgsql',
+    'host' => $argv[2],
+    'port' => '',
+    'charset' => 'utf8',
+    'dbname' => $argv[3],
+    'user' => $argv[4],
+    'password' => $argv[5],
+]);
+$config->set('useChromeNoSandbox', true);
+$config->save();