Bump s6-overlay so the image can run rootless on Kubernetes

[gabrielcosi]

Before You Submit

• I checked that my issue isn't already filed
• I checked the relevant Log in the Management Console

Describe the bug

Running ghcr.io/koush/scrypted:v0.144.1-noble-full on Kubernetes with a restricted PodSecurity profile (allowPrivilegeEscalation: false, capabilities.drop: ['ALL']) fails during s6-overlay's preinit:

/package/admin/s6-overlay/libexec/preinit: fatal: /run belongs to uid 0 instead of 1000 and we're lacking the privileges to fix it.

The s6-overlay version pinned in install/docker/Dockerfile.s6 is 3.1.5.0, which predates the upstream fix in 3.2.0.3:

• Upstream tracking issue: fatal: /run belongs to uid 0 instead of 999 just-containers/s6-overlay#600
• Upstream fix release: https://github.com/just-containers/s6-overlay/releases/tag/v3.2.0.3

paperless-ngx hit the same wall and resolved it by bumping s6-overlay: paperless-ngx/paperless-ngx#9609.

The current workaround is granting CHOWN, FOWNER, SETUID, SETGID, DAC_OVERRIDE, which defeats the point of drop: ['ALL'].

For the "start fully as a non-root UID" case, s6-overlay also exposes S6_YES_I_WANT_A_WORLD_WRITABLE_RUN_BECAUSE_KUBERNETES=1 (documented in the s6-overlay README), which lets it accept the /run ownership and permissions that Kubernetes sets up. A newer s6-overlay, plus optionally documenting that env var, would cover both the "root + drop:ALL" and the "non-root" setups.

To Reproduce

1. Deploy ghcr.io/koush/scrypted:v0.144.1-noble-full to Kubernetes.
2. Set the container securityContext to:

   allowPrivilegeEscalation: false
   capabilities:
     drop: ['ALL']

3. Pod fails on startup with the fatal preinit error above.

Expected behavior

Container starts under a restricted PodSecurity profile without needing extra Linux capabilities.

Logs

/package/admin/s6-overlay/libexec/preinit: fatal: /run belongs to uid 0 instead of 1000 and we're lacking the privileges to fix it.
s6-overlay-suexec: fatal: child failed with exit code 100

Server

• OS: Talos Linux, Kubernetes 1.35
• Installation Method: Docker image (ghcr.io/koush/scrypted:v0.144.1-noble-full) depl

Hardware Model

• N/A, the container fails before any plugin loads.

Client

• N/A

Additional context

The pin is in install/docker/Dockerfile.s6:

ARG S6_OVERLAY_VERSION=3.1.5.0

Bumping to 3.2.0.3 or newer should resolve it.