Kernel entrypoint fails on images without shadow-utils (distroless images with only a shell)

`/opt/kernel/entrypoint.sh` requires `getent`, `groupadd`, `useradd`, `usermod` and `chpasswd` from the session image, plus `sed` and `cut`. Images built without a package manager (distroless-style images that ship only bash) cannot start a session. Present on main, 26.8 and 26.4.

1. **User and group creation is skipped with warnings** — `groupadd`/`useradd`/`usermod` are missing, so the `work` account is never created and the `shadow`/`grpread`/`ADDITIONAL_GIDS` memberships are never applied.
1. **The final verification is fatal** — `getent passwd work | cut -d: -f3-4` evaluates to an empty string without `getent`, so the script prints `ERROR: /etc/passwd entry for 'work' does not match :` and exits 1 before `su-exec` runs.
1. **The password cannot be set** — `chpasswd -c SHA512` is missing, so even with a hand-made account, password SSH login through the bundled SSH server has no hash in `/etc/shadow`.

Everything else the entrypoint needs (su-exec, dropbear, the kernel runner Python, the hook library) is already bind-mounted by the agent under `/opt/kernel` and `/opt/backend.ai`, so the shadow-utils are the only remaining dependency on the image.

### Reproduction

Register an image that has `/bin/bash` but no `passwd`/`shadow-utils` package (for example a distroless base with bash copied in), create a session on it, and read the container log: the warnings from step 1 are followed by the `does not match` error and the container exits with status 1.

### Expected behavior

When the image lacks the tools, the entrypoint sets up the `work` user, its groups and its password by editing `/etc/passwd`, `/etc/group` and `/etc/shadow` directly, and the session starts as it does on a full distro image.

JIRA Issue: BA-7867

Start with /opt/kernel/entrypoint.sh and reproduce the failure using an image with /bin/bash but without passwd or shadow-utils; inspect the warnings and final verification error in the container log. Done means the entrypoint can create the work account, apply the requested groups, set its password, and start the session without those image tools.

Written by the indexing model from the issue text.