Add docker-rootless-cgroup module for cgroup v2 delegation

Rootless Docker only gets cgroup v2 controllers delegated when systemd
sets Delegate=yes on the user session. Kasm images have no systemd, so
the daemon comes up with CgroupDriver=none and `kind create cluster`
fails. This module reproduces that delegation by hand: evacuates the
cgroup-namespace root, delegates controllers into a user-owned /rootless
slice, installs a PATH shim that gives the daemon a private cgroup leaf
so it can self-evacuate, and restarts it. Guarded to no-op on systemd,
rootful, and non-Docker hosts; wired into bootstrap.sh last.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -43,6 +43,12 @@ Already have a clone? Just run it directly:
   `~/.local/bin`. Persists across redeploys; only rebuilt when the venv is
   missing or broken. Building it may install `python3`/`python3-venv` via
   the system package manager (the one place this module uses sudo).
+- `docker-rootless-cgroup/` — on systemd-less hosts (e.g. Kasm), hand-delegates
+  cgroup v2 controllers to the rootless Docker daemon so per-container cgroups
+  work and `kind` can create clusters (rootless Docker otherwise comes up with
+  `CgroupDriver=none`). Uses sudo for host cgroup writes and restarts the
+  daemon; no-ops on systemd or non-rootless hosts. Re-run at each bootstrap
+  (the cgroup layout resets on redeploy); its PATH shim lives in `$HOME`.
 - `mcp-config/` — shared MCP gateway config sync for laptops (LiteLLM /
   opencode). Independent of `bootstrap.sh`; see its own README.