Fix bgld Docker entrypoint command handling

[manuelsampedro1]

Summary

• fix the entrypoint root-drop guard to match the actual bgl_oneshot command used by this image
• remove the stray whitespace after the Dockerfile line-continuation for ca-certificates so the package install list is parsed correctly

Validation

• /bin/sh -n docker-entrypoint.sh
• git diff --check
• checked that stale btc_oneshot / malformed ca-certificates \\ patterns are gone with rg
• smoke-tested the root path with stubbed id, chown, and gosu commands; the entrypoint now delegates bgl_oneshot through gosu BGL