[BUG] - Docker image incompatible with readOnlyRootFilesystem (Kubernetes security best practice)

**Internal/External**
External

**Area**
Other - Docker image / Nix wrapper / run-node script

**Summary**
The cardano-node Docker image (10.6.2) is incompatible with `readOnlyRootFilesystem: true` in Kubernetes due to two separate issues:

1. **Scripts mode (`NETWORK=mainnet`)**: The Nix-generated wrapper hardcodes RTS option `-tcardano-node.stats` which tries to write to the current working directory
2. **Custom mode (`run` arg)**: The `/usr/local/bin/run-node` script writes to `/usr/local/bin/env`

Running with `readOnlyRootFilesystem: true` is a Kubernetes security best practice recommended by CIS benchmarks.

**Steps to reproduce**

**Issue 1 - Scripts mode:**
```bash
docker run --read-only -e NETWORK=mainnet ghcr.io/intersectmbo/cardano-node:10.6.2
```
Error: `cardano-node: Can't open stats file cardano-node.stats`

**Issue 2 - Custom mode:**
```bash
docker run --read-only ghcr.io/intersectmbo/cardano-node:10.6.2 run
```
Error: `/usr/local/bin/run-node: line 93: /usr/local/bin/env: Read-only file system`

**Expected behavior**
The node should start successfully with `readOnlyRootFilesystem: true`.

**System info:**
- OS: Kubernetes (EKS) with containerd
- Node version: cardano-node 10.6.2
- Docker image: `ghcr.io/intersectmbo/cardano-node:10.6.2`

**Logs - Issue 1 (Scripts mode)**
```
Starting: exec /nix/store/.../cardano-node run
...
+RTS
--machine-readable
-tcardano-node.stats
...
-RTS

cardano-node: Can't open stats file cardano-node.stats
```

**Logs - Issue 2 (Custom mode)**
```
Running cardano node ...
CARDANO_BIND_ADDR=0.0.0.0
CARDANO_BLOCK_PRODUCER=false
CARDANO_CONFIG=/opt/cardano/config/mainnet/config.json
CARDANO_DATABASE_PATH=/data/db
CARDANO_LOG_DIR=/opt/cardano/logs
CARDANO_PORT=3001
CARDANO_SOCKET_PATH=/ipc/node.socket
CARDANO_TOPOLOGY=/configuration/topology.json
/usr/local/bin/run-node: line 93: /usr/local/bin/env: Read-only file system
```

**Root Cause**
1. The Nix wrapper at `/nix/store/.../cardano-node-mainnet` hardcodes `-tcardano-node.stats` RTS option
2. The `run-node` script's `writeRootEnv()` function writes to `/usr/local/bin/env`

**Suggested Fix**
1. Make the stats file path configurable or write to `/tmp` or `/data`
2. Write the env file to a writable location like `/tmp/env` instead of `/usr/local/bin/env`
3. Or provide a "minimal" mode that skips these writes entirely

**Workaround**
Disable `readOnlyRootFilesystem` (reduces security posture).