bin/: add kind, gated on rootless Docker availability

kind needs a container runtime to create clusters, so only install it
when a rootless Docker daemon is actually reachable (SecurityOptions
reports name=rootless). Otherwise skip with a note.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/install.sh

@@ -20,6 +20,15 @@ REPO_ROOT="$(dirname -- "$SCRIPT_DIR")"
 ARCH="$(fetch_arch)"       # x86_64 / aarch64
 DEB="$(fetch_arch_deb)"    # amd64 / arm64
 
+# docker_rootless_available — true only if a rootless Docker daemon is up and
+# reachable. kind needs a container runtime to create clusters; on Kasm we run
+# Docker rootless (never system Docker), so kind is worth installing only when
+# that daemon answers. SecurityOptions lists name=rootless under rootless mode.
+docker_rootless_available() {
+  command -v docker >/dev/null 2>&1 || return 1
+  docker info -f '{{println .SecurityOptions}}' 2>/dev/null | grep -q 'name=rootless'
+}
+
 # jq — command-line JSON processor (single static binary).
 install_jq() {
   ver=1.8.2
@@ -58,6 +67,16 @@ install_k9s() {
   mark_version k9s "$ver"
 }
 
+# kind — run local Kubernetes clusters in Docker (single static binary). Gated
+# on rootless Docker at the call site since it is useless without a runtime.
+install_kind() {
+  ver=v0.32.0
+  have_version kind "$ver" && { fsay "kind $ver already installed."; return 0; }
+  install_raw_bin \
+    "https://github.com/kubernetes-sigs/kind/releases/download/$ver/kind-linux-$DEB" kind
+  mark_version kind "$ver"
+}
+
 # kubectx / kubens — fast context and namespace switching. Uses x86_64 token.
 install_kubectx() {
   ver=v0.11.0
@@ -119,6 +138,11 @@ install_jq
 install_kubectl
 install_helm
 install_k9s
+if docker_rootless_available; then
+  install_kind
+else
+  fsay "Skipping kind: rootless Docker not available."
+fi
 install_kubectx
 install_kubens
 install_stern