Fix dev_watcher sentinel path for container permissions

The sentinel was written to shared/_reload_sentinel.py but shared/ is
volume-mounted as root:root, so appuser can't create files there.
Move sentinel to /app/_reload_sentinel.py which is owned by appuser
and still under Hypercorn's --reload watch path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

shared/dev_watcher.py

@@ -13,7 +13,7 @@ import time
 import sys
 
 WATCH_EXTENSIONS = {".sx", ".sx", ".js", ".css"}
-SENTINEL = os.path.join(os.path.dirname(__file__), "_reload_sentinel.py")
+SENTINEL = "/app/_reload_sentinel.py"
 POLL_INTERVAL = 1.5  # seconds