fix(template): preserve filesystem lost+found during tmp wipe

[homelab-agent-bot]

Summary

• recognize a non-symlink, root-owned /tmp/lost+found as a filesystem-created structural directory
• preserve only that entry while the unprivileged container entrypoint wipes all ordinary scratch data
• document why the exception does not create unwiped user-controlled storage

Why

A fresh ephemeral filesystem can expose a protected lost+found directory. The workspace container runs unprivileged, so attempting to remove it marks the /tmp wipe as failed and causes the blocking agent startup script to fail even though no stale workspace data remains.

The entrypoint checks type and ownership instead of excluding the name unconditionally. A workspace user cannot create a root-owned entry, so a user-created lost+found is still removed.

Validation

• git diff --check
• bash -n templates/kubernetes/homelab-workspace/scripts/script-container-entrypoint.sh
• shellcheck templates/kubernetes/homelab-workspace/scripts/script-container-entrypoint.sh
• pre-commit run --files DESIGN.md templates/kubernetes/homelab-workspace/scripts/script-container-entrypoint.sh
• commit header validated with the repository's local commitlint installation