Fix judge image runtime permissions

[JacobLinCool]

Summary

• make copied runtime directories readable and traversable by the unprivileged wasmoj user before sealing the image
• import every judge runtime package and verify the embedded identity as wasmoj during the Docker build
• lock this permission and dependency smoke in the container build-context test

Production evidence

A real Official Submit failed both bounded attempts before any callback. Cloudflare historical logs and the exact production image both report ERR_MODULE_NOT_FOUND for @wasm-oj/core/dist/index.js. The file exists, but the renamed dist directory is 0500 root:root; the runtime user cannot traverse it.

Verification

• focused release tests: 12/12 PASS under Node 24.18
• full ESLint PASS
• real linux/amd64 image build PASS
• image Config.User is wasmoj
• declared-user /health and /identity PASS
• diff check PASS
• Jacob checkpoint PASS