Auto-update Claude Code on container boot

[ziweiwu]

Summary

• The image bakes Claude Code in at build time (Dockerfile L105), so users on the published coderluii/holyclaude:latest are pinned to whatever Claude Code version was current at build time.
• This PR adds a best-effort claude update step to entrypoint.sh that runs as the claude user on every boot, so containers pick up new Claude Code releases without an image rebuild.
• Behavior is gated by a new CLAUDE_AUTO_UPDATE env var (default true). Set it to false for air-gapped or version-pinned environments.

Failures are logged via [claude-update] prefix and never block startup, so a transient network issue or upstream outage won't break boot.

Files touched

• scripts/entrypoint.sh — new auto-update block, runs after first-boot bootstrap and before the ~/.claude.json persistence loop
• docker-compose.yaml — documents the new env var in the quick-start file
• docker-compose.full.yaml — documents the new env var alongside the other performance options

Test plan

• docker compose up -d on a fresh build — observe [entrypoint] Checking for Claude Code updates... followed by [claude-update]-prefixed output, and confirm docker exec -u claude holyclaude claude --version reports the latest release
• CLAUDE_AUTO_UPDATE=false docker compose up -d — confirm the update step is skipped
• Boot with no network — confirm the warning is logged and s6-overlay still starts cleanly

[ziweiwu]

Verified locally against coderluii/holyclaude:latest (digest sha256:e897a524...) by bind-mounting the patched entrypoint.sh over /usr/local/bin/entrypoint.sh.

Default (CLAUDE_AUTO_UPDATE=true):

[bootstrap] First-boot initialization complete.
[entrypoint] Checking for Claude Code updates...
[claude-update] Current version: 2.1.100
[claude-update] Checking for updates to latest version...
[claude-update] Successfully updated from 2.1.100 to version 2.1.138
[entrypoint] Starting s6-overlay...

Claude Code updated from the version baked into the published image (2.1.100) to the current release (2.1.138), then s6-overlay started cloudcli/xvfb cleanly.

Opt-out (CLAUDE_AUTO_UPDATE=false):

[bootstrap] First-boot initialization complete.
[entrypoint] Starting s6-overlay...

Update step skipped, no [claude-update] lines, services come up normally.

Failure path (no network) wasn't exercised live, but the logic is if ... 2>&1 | sed ...; then : ; else echo WARNING ...; fi, so a non-zero claude update only logs a warning and lets boot continue.