docker/: install rootful Docker; gate kind on it

kind never worked reliably against rootless Docker on Kasm, even with the
cgroup delegation from docker-rootless-cgroup/. So install full Docker
where we can, and flip bin/'s kind gate from "rootless is available" to
"a rootful daemon answers" — kind is simply skipped on Kasm now.

docker/install.sh no-ops when a rootless daemon is already running so it
never fights Kasm's setup. It runs before bin/ in bootstrap so the kind
gate can see the daemon it just started. zsh/zshrc re-execs via newgrp
when the account gained the docker group but the live shell predates it.

docker-rootless-cgroup/ keeps its delegation (still useful for
per-container resource limits); only its kind-centric comments change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/install.sh

@@ -20,13 +20,15 @@ REPO_ROOT="$(dirname -- "$SCRIPT_DIR")"
 ARCH="$(fetch_arch)"       # x86_64 / aarch64
 DEB="$(fetch_arch_deb)"    # amd64 / arm64
 
-# docker_rootless_available — true only if a rootless Docker daemon is up and
-# reachable. kind needs a container runtime to create clusters; on Kasm we run
-# Docker rootless (never system Docker), so kind is worth installing only when
-# that daemon answers. SecurityOptions lists name=rootless under rootless mode.
-docker_rootless_available() {
+# docker_full_available — true only if a non-rootless (full) Docker daemon is
+# up and reachable. kind needs full Docker: we could not get it working against
+# rootless Docker on Kasm, so it is only worth installing where a rootful
+# daemon answers. SecurityOptions lists name=rootless under rootless mode.
+docker_full_available() {
   command -v docker >/dev/null 2>&1 || return 1
-  docker info -f '{{println .SecurityOptions}}' 2>/dev/null | grep -q 'name=rootless'
+  _secopts="$(docker info -f '{{println .SecurityOptions}}' 2>/dev/null)" || return 1
+  [ -n "$_secopts" ] || return 1
+  ! printf '%s' "$_secopts" | grep -q 'name=rootless'
 }
 
 # jq — command-line JSON processor (single static binary).
@@ -68,9 +70,8 @@ install_k9s() {
 }
 
 # kind — run local Kubernetes clusters in Docker (single static binary). Gated
-# on rootless Docker at the call site since it is useless without a runtime.
-# On systemd-less hosts the rootless daemon also needs cgroup delegation before
-# kind can create clusters; see the docker-rootless-cgroup/ module.
+# on full (non-rootless) Docker at the call site: kind could not be made to
+# work against rootless Docker on Kasm, so it is skipped there.
 install_kind() {
   ver=v0.32.0
   have_version kind "$ver" && { fsay "kind $ver already installed."; return 0; }
@@ -150,10 +151,10 @@ install_jq
 install_kubectl
 install_helm
 install_k9s
-if docker_rootless_available; then
+if docker_full_available; then
   install_kind
 else
-  fsay "Skipping kind: rootless Docker not available."
+  fsay "Skipping kind: full (non-rootless) Docker not available."
 fi
 install_kubectx
 install_kubens