chore: initial import from KNEL/PFVCluster@041d311 [#769]

Split per O&M lane work order. Full history: KNEL/PFVCluster.
https://projects.knownelement.com/issues/769#note-4152

scripts/docker-run.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# docker-run.sh — canonical ephemeral-container wrapper.
+#
+# Keeps the host clean: every build/test/generation runs inside a pinned image.
+# Ensures output files are owned by the invoking user (not root).
+#
+# Usage:
+#   docker-run.sh <image> [command...]
+#       Runs <command> in <image> with the repo mounted at /data, cwd /data.
+#       With no command, drops into the image's default entrypoint.
+#   docker-run.sh --shell <image>
+#       Interactive shell inside the container (for debugging).
+#
+# Examples:
+#   docker-run.sh python:3.12-slim python3 -m pytest
+#   docker-run.sh pandoc/extra report.md -o report.pdf
+#   docker-run.sh --shell node:20
+set -euo pipefail
+
+HERE="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck disable=SC1091
+source "$HERE/lib/common.sh"
+
+SHELL_MODE=false
+case "${1:-}" in
+    --shell) SHELL_MODE=true; shift ;;
+    -h|--help)
+        sed -n '2,18p' "$0"; exit 0 ;;
+esac
+
+[ "$#" -ge 1 ] || { sed -n '2,18p' "$0"; exit 1; }
+
+if [ "$SHELL_MODE" = true ]; then
+    # ${SHELL:-sh} must expand inside the container, not in this outer shell.
+    # shellcheck disable=SC2016
+    docker_run "$1" sh -c 'exec "${SHELL:-sh}"'
+else
+    docker_run "$@"
+fi