dockerfile: allow runtime pip installs in venv

Dockerfile

@@ -73,8 +73,11 @@ RUN python -m pip uninstall -y vtk \
 #         python /opt/eval_job.py <submission_id> <zip_url>
 COPY eval_job.py /opt/eval_job.py
 
-# Drop privileges. HF Spaces conventionally run as uid 1000.
-RUN useradd -m -u 1000 user
+# Drop privileges. HF Spaces conventionally run as uid 1000. Keep the venv
+# writable so HF Jobs can install short-lived extras (for example baseline
+# LLM clients) through the orchestrator's --pip-install hook.
+RUN useradd -m -u 1000 user \
+    && chown -R user:user "$VIRTUAL_ENV"
 USER user
 WORKDIR /home/user