Silence expected warnings in the container build

[x3ek]

Description

The image build logs two warnings on every run (spotted in the first GHCR publish, #146). Both are expected conditions in a container build, not problems, but they're noise that makes real warnings easier to miss.

1. pip's root-user warning when installing uv in the base stage. Running as root is normal inside a build container; suppress with PIP_ROOT_USER_ACTION=ignore (env) or --root-user-action=ignore.
2. uv's "Failed to hardlink files; falling back to full copy" warning: the BuildKit cache mount lives on a different filesystem than the install target, so hardlinking can't work and the copy fallback is the intended behavior. Acknowledge with UV_LINK_MODE=copy.

Acceptance criteria

• A clean multi-arch build (the publish-image workflow) logs neither warning
• No behavior change to the built image

— Claude