feat(ST-mmuwreer): entrypoint preflight check /var/cache mount-type + writable

Faalt direct als /var/cache tmpfs is (ontbrekende bind-mount) of niet
schrijfbaar is. Geeft een WARNING voor /var/log/agent en /var/run/agent
als die op tmpfs staan.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bin/entrypoint.sh

@@ -21,6 +21,27 @@ log() { printf '[entrypoint] %s\n' "$*" >&2; }
 : "${AGENT_REPO_CACHE:=/var/cache/repos}"
 : "${AGENT_HEALTH_PORT:=8080}"
 
+# ----- 0. preflight: /var/cache mount-type + writable --------------------
+_cache_fs=$(stat -f -c %T /var/cache 2>/dev/null \
+    || stat -f /var/cache 2>/dev/null | awk '/Type:/{print $NF}')
+if [ "$_cache_fs" = "tmpfs" ]; then
+    log "FATAL: /var/cache is tmpfs (likely missing bind-mount). Fix docker-compose.yml en doe \`compose up -d --force-recreate\`."
+    exit 1
+fi
+if ! touch /var/cache/.write-test 2>/dev/null; then
+    log "FATAL: /var/cache niet writable als user $(id -u)."
+    exit 1
+fi
+rm -f /var/cache/.write-test
+log "/var/cache OK (fs=${_cache_fs})"
+# Lighter warning-only check voor log/state mounts
+for _d in "${AGENT_LOG_DIR}" "${AGENT_STATE_DIR}"; do
+    _d_fs=$(stat -f -c %T "$_d" 2>/dev/null || echo unknown)
+    if [ "$_d_fs" = "tmpfs" ]; then
+        log "WARN: ${_d} is tmpfs — overleeft geen container-herstart."
+    fi
+done
+
 # ----- 1. dirs op bind-mounts -------------------------------------------
 log "ensuring directories on bind-mounts"
 mkdir -p \