fix(deploy): runtime DNS re-resolution via resolv.conf-injected resolver, both runtimes

deploy/entrypoint-resolver.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+# 双运行时(Docker/podman)DNS 修复:镜像内 baked 的 resolver 地址无法同时成立
+# (Docker=127.0.0.11,podman aardvark=网络网关,见容器 /etc/resolv.conf)。
+# 启动前取 resolv.conf 首个 nameserver 注入 nginx 配置,保住 spec §11 的
+# 变量式 proxy_pass 运行时重解析(valid=10s,scale/重建后秒级感知新 IP)。
+set -eu
+RESOLVER=$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf 2>/dev/null || true)
+[ -n "$RESOLVER" ] || RESOLVER=127.0.0.11
+CONF=/etc/nginx/conf.d/default.conf
+sed -i "s#resolver [0-9a-fA-F:.]* valid=#resolver ${RESOLVER} valid=#" "$CONF"
+echo "entrypoint-resolver: resolver=${RESOLVER} injected into ${CONF}"
+if [ $# -gt 0 ]; then exec "$@"; fi
+exec nginx -g 'daemon off;'