feat: sync /etc with proper excludes + pip package persistence

- Restore /etc/ sync with relative-path excludes for container-managed
files (hostname, hosts, resolv.conf, alternatives, ld.so.cache)
- Add pip freeze/install cycle for pip package persistence
- Upload pip-packages.txt alongside user-packages.list

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

entrypoint.py

@@ -3,7 +3,7 @@
 HuggingRun v2 — Ubuntu Server on HuggingFace Spaces.
 
 Persistence via HF Dataset (direct file sync, no archives):
-  - Sync scope: /home, /root, /usr/local, /opt, /var/lib, /etc/ssh
+  - Sync scope: /home, /root, /usr/local, /opt, /var/lib, /etc
   - System packages: saved as package name list, restored via apt install
   - Symlinks/permissions safe: no system binary dirs synced
 """
@@ -29,14 +29,21 @@ TTYD_PORT = os.environ.get("TTYD_PORT", "7681")
 LOGFILE = "/var/log/huggingrun.log"
 BASE_PKG_FILE = "/etc/base-packages.list"
 PKG_FILE = os.path.join(PERSIST_PATH, "user-packages.list")
+PIP_FILE = os.path.join(PERSIST_PATH, "pip-packages.txt")
 
 # Directories to sync (user data only, no system binaries)
-# NOTE: /etc/ssh only (for host keys), NOT all of /etc/ (breaks sshd/PAM)
-SYNC_DIRS = ["/home", "/root", "/usr/local", "/opt", "/var/lib", "/etc/ssh"]
+SYNC_DIRS = ["/home", "/root", "/usr/local", "/opt", "/var/lib", "/etc"]
 
-# Exclude from rsync
+# Exclude from rsync (relative paths — rsync matches from transfer root)
 RSYNC_EXCLUDES = ["*.sock", "*.pid", "*.lock"]
 
+# Extra excludes only for /etc/ restore (container-managed files)
+ETC_RESTORE_EXCLUDES = [
+    "hostname", "hosts", "resolv.conf", "mtab", "fstab",
+    "alternatives",     # symlinks managed by dpkg
+    "ld.so.cache",      # rebuilt by ldconfig
+]
+
 # Exclude from HF upload
 UPLOAD_IGNORE = [
     "__pycache__", "*.pyc", ".git", ".git*",
@@ -136,11 +143,15 @@ def restore():
 
     # Rsync each directory back (no --delete, don't remove existing files)
     log("── RESTORE: rsync /data/ → /")
-    excludes = " ".join(f"--exclude='{e}'" for e in RSYNC_EXCLUDES)
+    base_excludes = " ".join(f"--exclude='{e}'" for e in RSYNC_EXCLUDES)
+    etc_excludes = " ".join(f"--exclude='{e}'" for e in ETC_RESTORE_EXCLUDES)
     for d in SYNC_DIRS:
         src = os.path.join(PERSIST_PATH, d.lstrip("/"))
         if not os.path.isdir(src):
             continue
+        excludes = base_excludes
+        if d == "/etc":
+            excludes = f"{base_excludes} {etc_excludes}"
         cmd = f"rsync -rlptD {excludes} '{src}/' '{d}/'"
         rc, _ = sh(cmd, log_err=True)
         if rc == 0:
@@ -167,6 +178,18 @@ def restore():
     else:
         log("── RESTORE: no package list")
 
+    # Reinstall pip packages
+    if os.path.exists(PIP_FILE):
+        with open(PIP_FILE) as f:
+            pip_pkgs = [l.strip() for l in f if l.strip() and not l.startswith('#')]
+        if pip_pkgs:
+            log(f"── RESTORE: pip install {len(pip_pkgs)} packages")
+            rc, _ = sh(f"pip install --break-system-packages -q -r '{PIP_FILE}'")
+            if rc == 0:
+                log(f"  pip packages restored")
+            else:
+                log(f"  some pip packages failed")
+
     # Fix SSH key permissions (HF dataset doesn't preserve permissions)
     sh("chmod 600 /etc/ssh/ssh_host_*_key 2>/dev/null")
     sh("chmod 644 /etc/ssh/ssh_host_*_key.pub 2>/dev/null")
@@ -211,6 +234,12 @@ def save_and_upload():
         with open(PKG_FILE, "w") as f:
             f.write(out + "\n")
 
+    # Save pip package list (user-installed only, exclude base)
+    rc, out = sh("pip freeze --exclude-editable 2>/dev/null")
+    if rc == 0 and out:
+        with open(PIP_FILE, "w") as f:
+            f.write(out + "\n")
+
     # Rsync each sync dir → /data/
     excludes = " ".join(f"--exclude='{e}'" for e in RSYNC_EXCLUDES)
     for d in SYNC_DIRS:
@@ -234,16 +263,17 @@ def save_and_upload():
     ok = 0
     fail = 0
 
-    # Upload package list file
-    if os.path.exists(PKG_FILE):
-        try:
-            api.upload_file(
-                path_or_fileobj=PKG_FILE, path_in_repo="user-packages.list",
-                repo_id=HF_DATASET_REPO, repo_type="dataset",
-                commit_message=f"sync {ts}: packages",
-            )
-        except Exception:
-            pass
+    # Upload package list files
+    for pf, name in [(PKG_FILE, "user-packages.list"), (PIP_FILE, "pip-packages.txt")]:
+        if os.path.exists(pf):
+            try:
+                api.upload_file(
+                    path_or_fileobj=pf, path_in_repo=name,
+                    repo_id=HF_DATASET_REPO, repo_type="dataset",
+                    commit_message=f"sync {ts}: {name}",
+                )
+            except Exception:
+                pass
 
     # Upload each sync dir
     for d in SYNC_DIRS: