chore(bootstrap): trace root-only setup via run()

Introduce a run() helper that shell-quotes and prints each command before execution, and use it for mkdir/chown/chmod in the /usr/local-only Python target loop. This makes permission and path fixes visible in logs for easier debugging, preserves existing error-tolerance with || true, and remains compatible with set -euo pipefail and the runuser re-exec (runs only in the root branch). No functional changes beyond added verbosity; non-/usr/local paths remain no-op.

entrypoint.sh

@@ -51,6 +51,27 @@ if d:
 log("Finished emitting target directories")
 PY
 )
+ # Echo helper
+  run() {
+    printf '+ '
+    printf '%q ' "$@"
+    printf '\n'
+    "$@"
+  }
+  
+  for d in "${PY_PATHS[@]}"; do
+    case "$d" in
+      /usr/local|/usr/local/*)
+        run mkdir -p "$d" || true
+        run chown -R "${APP_USER}:${APP_GROUP}" "$d" || true
+        run chmod -R u+rwX,g+rwX "$d" || true
+        ;;
+      *)
+        :
+        ;;
+    esac
+  done
+
   for d in "${PY_PATHS[@]}"; do
     case "$d" in
       /usr/local|/usr/local/*)