A plain `docker run -v ./data:/app/data` bind mount owned by the host
user had its uid taken over (chown to 999) and its contents left
unwritable, because the adoption probe only looked at the generations
subdir, which `mkdir -p` had just created root-owned. Probe /app/data
first and fall back to generations; re-own only what the old uid owned;
chown a dir only when root created it; and let a read-only HF cache
mount through (the app only warns about it) instead of aborting on the
bare chown error.
