intel: fix VA-API encoders not registering (no element "vah264enc") (#721)

* intel: fix VA-API encoders not registering (no element "vah264enc")

The intel images fail to stream with a hardware encoder on stock config:
every client connect ends with '(pipeline error) no element "vah264enc"'.

There are three problems, all of which are needed to fix it:

1. The render group never reaches the neko process. supervisord resolves the
   supplementary groups of each program from /etc/group when it spawns it, but
   'rendergroup-init' (which calls usermod) is spawned in the same pass, so the
   neko process usually starts before the group has been assigned and cannot
   access /dev/dri/render*. Assign the group in an entrypoint, before
   supervisord starts, instead.

2. libva does not initialize the X11 display without an explicitly selected
   driver in this image, it fails with 'vaGetDriverNames() failed'. Set
   LIBVA_DRIVER_NAME=iHD, which is the only driver installed by the intel image.

3. GStreamer only registers the VA-API elements if a usable VA display is found
   while the plugins are scanned for the first time, and the outcome is cached
   in the user's registry. neko performs that scan at startup, before the X
   server is ready, so the cache ends up without vah264enc/vah264dec and stays
   that way. Wait for VA to be usable and drop the stale registry before
   starting neko.

* intel: keep the wrapper and the supervisord override in the intel image

Per the review on #721: no wrapper in every flavour with a runtime 'vainfo'
check, it should only be in the intel image.

- neko-serve moved to runtime/intel/neko-serve and is copied only by
  Dockerfile.intel. The 'command -v vainfo' check is dropped, only the intel
  image ships it.
- The [program:neko] block is overridden with runtime/intel/supervisord.neko.conf,
  copied to /etc/neko/supervisord/neko.conf. [include] is parsed after the main
  config and the last definition of a program wins, so supervisord.conf keeps
  'neko serve' and it does not have to be touched. Same mechanism as
  supervisord.nvidia.conf in the app images.
- runtime/supervisord.conf, runtime/Dockerfile and runtime/Dockerfile.nvidia are
  back to their previous content.

runtime/Dockerfile.intel

@@ -82,12 +82,14 @@ RUN set -eux; \
 # copy runtime configs
 COPY --chown=neko:neko .Xresources /home/$USERNAME/.Xresources
 COPY dbus /usr/bin/dbus
+COPY intel/neko-serve /usr/bin/neko-serve
 COPY default.pa /etc/pulse/default.pa
 COPY supervisord.conf /etc/neko/supervisord.conf
 COPY supervisord.dbus.conf /etc/neko/supervisord.dbus.conf
+COPY intel/supervisord.neko.conf /etc/neko/supervisord/neko.conf
 COPY xorg.conf /etc/neko/xorg.conf
 COPY intel/add-render-group.sh /usr/bin/add-render-group.sh
-COPY intel/supervisord.rendergroup.conf /etc/neko/supervisord/supervisord.rendergroup.conf
+COPY intel/entrypoint.sh /usr/bin/entrypoint.sh
 
 #
 # copy runtime folders
@@ -106,6 +108,10 @@ ENV NEKO_PLUGINS_ENABLED=true
 ENV NEKO_PLUGINS_DIR=/etc/neko/plugins/
 ENV NEKO_HWENC=VAAPI
 ENV RENDER_GID=
+# libva does not initialize the X11 display without an explicitly selected
+# driver here ('vaGetDriverNames() failed'), and the GStreamer VA plugin scan
+# uses X11. This image only ships the iHD driver (intel-media-va-driver-non-free).
+ENV LIBVA_DRIVER_NAME=iHD
 
 #
 # add healthcheck
@@ -116,4 +122,5 @@ HEALTHCHECK --interval=10s --timeout=5s --retries=8 \
 
 #
 # run neko
+ENTRYPOINT ["/usr/bin/entrypoint.sh"]
 CMD ["/usr/bin/supervisord", "-c", "/etc/neko/supervisord.conf"]