Use extraCommands instead of runAsRoot in Docker build

runAsRoot requires KVM which isn't available in CI containers.
extraCommands achieves the same result without virtualization.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker.nix

@@ -44,10 +44,10 @@ pkgs.dockerTools.buildImage {
     ];
   };
 
-  runAsRoot = ''
+  # Create required directories without runAsRoot (which needs KVM)
-    #!${pkgs.stdenv.shell}
+  extraCommands = ''
-    mkdir -p -m 1777 /tmp
+    mkdir -p -m 1777 tmp
-    mkdir -p /var/lib/animaltrack
+    mkdir -p var/lib/animaltrack
   '';
 
   config = {