Stage: run the per-member key seed from the image, not the volume

Ready to build, not yet deployed — deploying the repointed scheduler command
without the new image would break the seed on schedule, which is why this sits on
a branch with the ordering written down.

- Dockerfile: COPY sync-keys.js /app/code/sync-keys.js; rule 3 in the header now
  states the one exception (operational scripts that must not depend on a volume).
- CloudronManifest.json: scheduler command repointed to /app/code/sync-keys.js.
- README: ordering (build -> deploy -> verify -> delete the volume copy), and the
  table row moved from the volume layer to the image layer.

After deploy: delete /app/data/sync-keys.js, but keep it until you are past the
rollback window — the previous image tag still runs the volume copy.

Dockerfile

@@ -15,7 +15,9 @@
 #      built from this repo on every deploy (the base FROM stays the appstore
 #      image we validated). A stale dockerImage pin silently redeploys an old
 #      build — that is what broke the sandbox on 2026-10-18/19.
-#   3. This image changes ONLY static brand assets. All behavior lives on the
+#   3. This image changes ONLY static brand assets plus operational scripts that
+#      must not depend on the persistent volume (currently sync-keys.js, run by
+#      the manifest's scheduler task). All other behavior lives on the
 #      persistent volume (/app/data/librechat.yaml, /app/data/env,
 #      /app/data/mcp/) and survives image updates unchanged.
 FROM cloudron/ai.librechat.cloudronapp:202610150224320000
@@ -41,6 +43,12 @@ COPY assets/custom.css /app/code/librechat/client/dist/assets/custom.css
 # rebuild trigger
 COPY assets/custom2.js /app/code/librechat/client/dist/assets/custom2.js
 
+# Per-member key seed (manifest scheduler task `librechat_key_sync`). Shipping it
+# in the image rather than on the volume means it cannot vanish with a volume
+# restore and cannot drift from this repo; the script prints its own md5 prefix
+# on every run so the running revision is auditable.
+COPY sync-keys.js /app/code/sync-keys.js
+
 # Co-op UI strings: rename the "MCP Servers" button to "Tools" and replace
 # the LibreChat footer tagline with the co-op footer. Non-fatal at build.
 COPY patch_ui_strings.py /app/code/patch_ui_strings.py