fix(devops): bypass OpenBao base entrypoint to prevent dev-mode flags

The base openbao image's docker-entrypoint.sh injects -dev-root-token-id
and -dev-listen-address flags when it sees 'server' as $1, causing the
server to exit immediately (code 0). Override entrypoint with dumb-init
and call bao directly to avoid the dev-mode flag injection.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.openbao.yml

@@ -15,7 +15,8 @@ services:
   # ======================
   openbao:
     image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-dev}
-    command: server -config=/openbao/config/config.hcl
+    entrypoint: ["dumb-init", "--"]
+    command: ["bao", "server", "-config=/openbao/config/config.hcl"]
     environment:
       OPENBAO_ADDR: http://0.0.0.0:8200
     volumes:

docker-compose.portainer.yml

@@ -27,7 +27,8 @@ services:
   openbao:
     image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-dev}
     container_name: mosaic-openbao
-    command: server -config=/openbao/config/config.hcl
+    entrypoint: ["dumb-init", "--"]
+    command: ["bao", "server", "-config=/openbao/config/config.hcl"]
     environment:
       OPENBAO_ADDR: http://0.0.0.0:8200
     ports:

docker-compose.swarm.yml

@@ -84,7 +84,8 @@ services:
   # ======================
   openbao:
     image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-latest}
-    command: server -config=/openbao/config/config.hcl
+    entrypoint: ["dumb-init", "--"]
+    command: ["bao", "server", "-config=/openbao/config/config.hcl"]
     env_file: .env
     environment:
       OPENBAO_ADDR: http://0.0.0.0:8200

docker-compose.yml

@@ -269,6 +269,7 @@ services:
     environment:
       VAULT_ADDR: http://0.0.0.0:8200
       SKIP_SETCAP: "true"
+    entrypoint: ["dumb-init", "--"]
     command: ["bao", "server", "-config=/openbao/config/config.hcl"]
     cap_add:
       - IPC_LOCK

docker/docker-compose.build.yml

@@ -273,6 +273,7 @@ services:
     environment:
       VAULT_ADDR: http://0.0.0.0:8200
       SKIP_SETCAP: "true"
+    entrypoint: ["dumb-init", "--"]
     command: ["bao", "server", "-config=/openbao/config/config.hcl"]
     cap_add:
       - IPC_LOCK

docker/docker-compose.yml

@@ -82,8 +82,8 @@ services:
     environment:
       VAULT_ADDR: http://0.0.0.0:8200
       SKIP_SETCAP: "true"
-    entrypoint: ["/bin/sh", "-c"]
+    entrypoint: ["dumb-init", "--"]
-    command: ["bao server -config=/openbao/config/config.hcl"]
+    command: ["bao", "server", "-config=/openbao/config/config.hcl"]
     cap_add:
       - IPC_LOCK
     healthcheck: