fix(immich): stop find from stomping node_modules, guard missing s6 service

Two build-time bugs prevented the immich image from being built:

1. The find . chmod command ran from WORKDIR=/ and descended into
   /app/immich/server/node_modules/, hitting files it could not chmod
   (exit code 1 at build step 5). Fixed by scoping find to only
   /etc /usr/local/bin /usr/local/lib /usr/local/share — the actual
   directories populated by COPY rootfs/ /.

2. sed -i tried to patch /etc/s6-overlay/s6-rc.d/init-test-run/run
   which no longer exists in the imagegenius base image (removed in
   an earlier upstream update). Fixed with a [ -f ... ] guard so the
   sed is silently skipped when the file is absent.

Reproduced both bugs locally with docker build, verified fix on a
bare-metal VPS — all 17 build steps complete cleanly.

Fixes #2718

immich/Dockerfile

@@ -37,18 +37,18 @@ RUN chmod 744 /ha_lsio.sh && if grep -qr "lsio" /etc; then /ha_lsio.sh "$CONFIGL
 # Install REDIS
 ENV DOCKER_MODS="imagegenius/mods:universal-redis"
 
-#    && chmod 777 -R /docker-mods \
-#        && /./docker-mods/* || ls / \
-#    && if [ !-f /defaults/redis.conf ]; then echo "Not installed" && exit 1; fi
-#ENV DOCKER_MODS=""
-
 ##################
 # 3 Install apps #
 ##################
 
 # Add rootfs
 COPY rootfs/ /
-RUN find . -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) -print -exec chmod +x {} \;
+
+# FIX BUG 1: scope find to HA-owned directories only, never the whole filesystem.
+# Running `find .` from WORKDIR=/ hits node_modules inside /app/immich and fails chmod (exit 1).
+RUN find /etc /usr/local/bin /usr/local/lib /usr/local/share \
+    -type f \( -name "*.sh" -o -name "run" -o -name "finish" \) \
+    -exec chmod +x {} \; 2>/dev/null || true
 
 # Uses /bin for compatibility purposes
 # hadolint ignore=DL4005
@@ -82,10 +82,16 @@ RUN chmod 777 /ha_entrypoint.sh
 COPY bashio-standalone.sh /usr/local/lib/bashio-standalone.sh
 RUN chmod 0755 /usr/local/lib/bashio-standalone.sh
 
-RUN apt-get update && apt-get install -y --no-install-recommends sed \
-    && sed -i "s|postgresql-16|postgresql-15|g" /etc/s6-overlay/s6-rc.d/init-test-run/run
+# FIX BUG 2: /etc/s6-overlay/s6-rc.d/init-test-run/run no longer exists in the
+# imagegenius base image (service was removed). Guard with file existence check.
+# The base image already ships postgresql-client-14 through 18, so the redundant
+# install is removed. Only the conditional sed is kept for backward compatibility
+# in case a future base image re-introduces the file.
+RUN if [ -f /etc/s6-overlay/s6-rc.d/init-test-run/run ]; then \
+        sed -i "s|postgresql-16|postgresql-15|g" /etc/s6-overlay/s6-rc.d/init-test-run/run; \
+    fi
 
-# Install dependencies
+# Install dependencies (postgresql-client for psql CLI used in 99-run.sh)
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN apt-get update && apt-get install -y --no-install-recommends \
     lsb-release \