docker: the entrypoint runs prepare itself; compose up pulls the prebuilt image

Two gaps between "the image is prebuilt" and how people actually run it.
`docker compose up` on a fresh checkout still built locally, because compose
prefers build over pull when a service declares both; `pull_policy: missing`
fixes that — `up -d` now pulls, and `docker compose build` (or `up --build`)
remains the explicit local path. And a bare `docker run` of the image aborted
in verify because nothing had prepared the model; the entrypoint now runs the
idempotent docker/prepare.sh before verify.sh, so an empty models volume
fills itself on the first boot, a prepared one costs a state check measured
in seconds, and a half-prepared one heals (PREPARE=0 opts out). That makes
plain Docker a one-command install:

  docker run -d --name qwen --gpus all --ipc=host -p 18020:18020 \
    -v qwen-models:/app/models -v qwen-cache:/cache \
    --restart unless-stopped ghcr.io/syv-ai/qwen38-27b-rtx3090:latest

Verified against the pulled ghcr image on the 3090: auto-prepare starts the
download on an empty volume, prepare on a complete model is a no-op state
check, and the one-liner boots to /health 200 and serves (135 s with a warm
compile cache).