Add Docker UID matching best practice

Pattern for matching container user UID/GID to mounted volume owner
via a gosu-based entrypoint wrapper. Covers UID conflicts (Ubuntu 24.04
ships ubuntu:1000), K8s securityContext compatibility, and alternatives.

Learned from agent-runtimes M1 where Claude Code refuses
--dangerously-skip-permissions as root.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

BESTPRACTICES.md

@@ -18,3 +18,5 @@ Generalised best practices extracted from real project work. Each topic file is
 - [Linting & Formatting](best-practices/linting.md) — Tool choices per language, PostToolUse hook, pre-commit integration, formatter contract
 - [Spec-Driven Development](best-practices/spec-driven-development.md) — Spec structure, requirement numbering, test-first workflow, context tiers, anti-patterns
 - [Test-Driven Development](best-practices/test-driven-development.md) — Edge case discovery, property-based testing, mutation testing, AI agent testing patterns, test architecture
+- [Networking & Infrastructure](best-practices/networking.md) — nftables safety, systemd socket activation, Docker forwarding, TLS SNI vs Host header, wildcard certs
+- [Docker UID Matching](best-practices/docker-uid-matching.md) — UID wrapper entrypoint for mounted volumes, gosu pattern, when to use vs K8s securityContext