Switch to ich777/novnc-baseimage and fix stale X lock on restart

jayfield/novnc-baseimage no longer resolves, so point at the public
ich777/novnc-baseimage instead. That image lays out TurboVNC, websockify,
and noVNC via standard package paths rather than /opt/TurboVNC and
/tmp/websockify /tmp/noVNC, so server.sh is updated to match.

Also remove any stale .X99-lock/.X11-unix socket before starting Xvnc,
since /tmp survives docker stop/start and previously left Xvnc unable to
rebind the display on restart. Signal exit-code math in signals.sh now
uses bash arithmetic instead of bc, which isn't present in the new base
image.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RZjg4yXCYacriPz3euenQF

scripts/server.sh

@@ -5,8 +5,13 @@ RFB_PORT=59${DISPLAY_NUM}
 NOVNC_PORT=80${DISPLAY_NUM}
 
 echo Display at ${DISPLAY} with ${SCREEN_W}x${SCREEN_H}x24
-/opt/TurboVNC/bin/Xvnc ${DISPLAY} -geometry ${SCREEN_W}x${SCREEN_H} -depth 24 +xinerama -securitytypes none >/var/log/xvfb.log &
+
+# Xvnc doesn't get a chance to clean these up when the container is killed/stopped,
+# and /tmp persists across `docker restart`, so a stale lock blocks the next start.
+rm -f /tmp/.X${DISPLAY_NUM}-lock /tmp/.X11-unix/X${DISPLAY_NUM}
+
+Xvnc ${DISPLAY} -geometry ${SCREEN_W}x${SCREEN_H} -depth 24 +xinerama -securitytypes none >/var/log/xvfb.log &
 fluxbox &
-/tmp/websockify/run -D --web=/tmp/noVNC/ --cert=/tmp/novnc.pem --key=/tmp/novnc.key ${NOVNC_PORT} localhost:${RFB_PORT}
+websockify -D --web=/usr/share/novnc/ --cert=/tmp/novnc.pem --key=/tmp/novnc.key ${NOVNC_PORT} localhost:${RFB_PORT}
 socat TCP-LISTEN:60${DISPLAY_NUM},fork,bind=0.0.0.0 UNIX-CONNECT:/tmp/.X11-unix/X${DISPLAY_NUM}
 

scripts/signals.sh

@@ -21,5 +21,5 @@ signal_name_to_number() {
 signal_return_val() {
     SIGNAME="$1"
     SIGNUM=$(signal_name_to_number ${SIGNAME})
-    echo "128 + $SIGNUM" | bc
+    echo $((128 + SIGNUM))
 }