fix: move ollama install to start.sh for faster build, prevent Space pause during build

fix: add zstd for ollama install

fix: add USER root before apt-get in Dockerfile

clean: full pipeline, no secrets in history