Add USER 65534:65534 to the scratch runtime image so the checker
process does not run as root.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The SDK split the HTTP server scaffolding into the new
checker-sdk-go/checker/server subpackage. Update main.go to import
server and call server.New, and isolate the interactive form code
behind the standalone build tag so plugin/builtin builds skip
net/http entirely.
