fix(entrypoint): ensure_writable bind-mounts + add log-cleanup (>2d)

- entrypoint.sh: chown → chmod a+rwX → fail-fast met diagnostiek voor
  AGENT_STATE_DIR en AGENT_LOG_DIR. Lost stille state.json permission
  denied op QNAP-share op (NAS-ACL blokkeert chown vanuit container).
- bin/log-cleanup.sh: nieuwe hard-delete >2d (env-tunable) naast de
  conservatievere rotate-logs.sh (gzip 24u, delete 30d).
- run-agent.sh: roept log-cleanup.sh aan bij startup en elke iteratie.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bin/log-cleanup.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# log-cleanup.sh — verwijder log-bestanden ouder dan N dagen
+#
+# Default 2 dagen. Override via env AGENT_LOG_HARD_DELETE_DAYS.
+# Werkt op alles onder ${AGENT_LOG_DIR} (runs/, jobs/, *.log,
+# health-server.log, repo-bootstrap.log).
+#
+# Loopt parallel aan rotate-logs.sh (compressie + 30d delete) en is
+# bewust apart zodat de gzip-rotatie onafhankelijk blijft van de
+# hard delete.
+
+set -uo pipefail
+
+: "${AGENT_LOG_DIR:=/var/log/agent}"
+: "${AGENT_LOG_HARD_DELETE_DAYS:=2}"
+
+find "${AGENT_LOG_DIR}" -type f \
+    \( -name '*.log' -o -name '*.log.gz' -o -name '*.txt' -o -name '*.json' \) \
+    -mtime "+${AGENT_LOG_HARD_DELETE_DAYS}" -delete 2>/dev/null || true
+
+find "${AGENT_LOG_DIR}/jobs" -mindepth 1 -type d -empty -delete 2>/dev/null || true