fix(collabora): run the build smoke test as the cool user

coolwsd refuses to start as root, so "coolwsd --version" failed the build even
though it proved what it was there to prove: the payload copied out of the
distroless image links and executes on the Debian base. Run it through su as
uid 1001, which is also exactly how 99-run.sh launches it.

Also drop --system from the useradd/groupadd, which only produced a
"uid 1001 is greater than SYS_UID_MAX 999" warning.

Co-Authored-By: Claude <noreply@anthropic.com>

collabora/Dockerfile

@@ -96,8 +96,8 @@ COPY --from=collabora /opt/cool /opt/cool
 # Recreate the runtime user the official image declares (uid/gid 1001), and the
 # per-container state upstream sets up in its own final build stage.
 RUN \
-    groupadd --system --gid 1001 cool && \
-    useradd --system --uid 1001 --gid 1001 --home-dir /opt/cool --shell /usr/sbin/nologin cool && \
+    groupadd --gid 1001 cool && \
+    useradd --uid 1001 --gid 1001 --no-create-home --home-dir /opt/cool --shell /usr/sbin/nologin cool && \
     mkdir -p /opt/cool/child-roots /opt/cool/cache && \
     chown -R 1001:1001 /opt/cool /etc/coolwsd && \
     chmod 640 /etc/coolwsd/coolwsd.xml && \
@@ -109,11 +109,11 @@ RUN \
 
 # Fail the build rather than ship an image that cannot start: ha_autoapps.sh is
 # invoked with "|| true", and coolwsd comes from an image built against a
-# different libc, so both are worth proving here.
+# different libc, so both are worth proving here. coolwsd refuses to run as
+# root, so this runs it exactly the way 99-run.sh does.
 RUN \
     command -v openssl > /dev/null && \
-    command -v su > /dev/null && \
-    /usr/bin/coolwsd --version
+    su -s /bin/bash cool -c "/usr/bin/coolwsd --version"
 
 ################
 # 4 Entrypoint #