fix: add zstd for ollama install

fix: add USER root before apt-get in Dockerfile

clean: full pipeline, no secrets in history