Add docker-rootless-cgroup module for cgroup v2 delegation

Rootless Docker only gets cgroup v2 controllers delegated when systemd
sets Delegate=yes on the user session. Kasm images have no systemd, so
the daemon comes up with CgroupDriver=none and `kind create cluster`
fails. This module reproduces that delegation by hand: evacuates the
cgroup-namespace root, delegates controllers into a user-owned /rootless
slice, installs a PATH shim that gives the daemon a private cgroup leaf
so it can self-evacuate, and restarts it. Guarded to no-op on systemd,
rootful, and non-Docker hosts; wired into bootstrap.sh last.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/install.sh

@@ -69,6 +69,8 @@ install_k9s() {
 
 # kind — run local Kubernetes clusters in Docker (single static binary). Gated
 # on rootless Docker at the call site since it is useless without a runtime.
+# On systemd-less hosts the rootless daemon also needs cgroup delegation before
+# kind can create clusters; see the docker-rootless-cgroup/ module.
 install_kind() {
   ver=v0.32.0
   have_version kind "$ver" && { fsay "kind $ver already installed."; return 0; }