docker/: install rootful Docker; gate kind on it

kind never worked reliably against rootless Docker on Kasm, even with the
cgroup delegation from docker-rootless-cgroup/. So install full Docker
where we can, and flip bin/'s kind gate from "rootless is available" to
"a rootful daemon answers" — kind is simply skipped on Kasm now.

docker/install.sh no-ops when a rootless daemon is already running so it
never fights Kasm's setup. It runs before bin/ in bootstrap so the kind
gate can see the daemon it just started. zsh/zshrc re-execs via newgrp
when the account gained the docker group but the live shell predates it.

docker-rootless-cgroup/ keeps its delegation (still useful for
per-container resource limits); only its kind-centric comments change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

zsh/zshrc

@@ -2,6 +2,19 @@
 # overwritten on the next bootstrap run. Edit zsh/zshrc in the dotfiles repo
 # instead.
 
+# If this account was added to the docker group (dotfiles/docker/install.sh)
+# but this shell's session predates that, re-exec via newgrp so docker works
+# without a full logout. Guarded: fires only when the group is on the account
+# yet missing from the running shell's groups, so the newgrp'd shell (which
+# has the group) cannot loop.
+# Only for real terminals ([ -t 0 ]): newgrp replaces the shell and would
+# swallow the command in scripted `zsh -i -c ...` invocations.
+if [ -t 0 ] && [ -S /var/run/docker.sock ] \
+   && id -nG "${USER:-$(id -un)}" 2>/dev/null | grep -qw docker \
+   && ! id -Gn 2>/dev/null | grep -qw docker; then
+  exec newgrp docker
+fi
+
 # Userland tools installed by dotfiles/bin/install.sh live here.
 case ":$PATH:" in
   *":$HOME/.local/bin:"*) ;;