docker: install from the docker-ce repo on RHEL-family hosts

bootstrap failed outright on Oracle Linux: docker/install.sh piped
get.docker.com to sh, and that script allowlists distros by /etc/os-release
ID, so it aborted with "ERROR: Unsupported distribution 'ol'".

On a distro it does recognize, the convenience script only adds the repo and
installs the packages -- exactly what install_rhel() now does directly. Doing
it ourselves drops the allowlist, so every EL rebuild (Oracle, Rocky, Alma,
CentOS, RHEL) goes through one code path instead of needing to be enumerated.
Debian-family still uses get.docker.com. containerd.io needs --allowerasing to
replace the runc that Oracle Linux ships.

Also stop one failed module from killing the whole run: modules were bare
calls under `set -eu`, so docker/'s exit meant bin/, node/ and ansible/
silently never ran -- an unsupported distro string left the box with no CLIs,
no npx and no ansible. run_module warns and continues, then bootstrap exits
non-zero with a summary of what failed. Same guard 35befbe added for
individual tools in bin/install.sh, one level up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bootstrap.sh

@@ -43,15 +43,38 @@ if ! command -v python3 >/dev/null 2>&1 && ! command -v unzip >/dev/null 2>&1; t
   pkg_install python3 || echo "bootstrap: warning: could not install python3" >&2
 fi
 
-"$SCRIPT_DIR/zsh/install.sh"
-"$SCRIPT_DIR/git/install.sh"
+# run_module <path> — run one module; on failure, warn and keep going.
+#
+# WHY: these used to be bare calls, so under `set -eu` the FIRST failing module
+# aborted bootstrap and every later module silently never ran — one unsupported
+# distro in docker/ was enough to leave a box with no CLIs, no npx and no
+# ansible. The modules are independent, so a failure in one is not a reason to
+# skip the rest. (bin/install.sh does the same for individual tools; this is
+# that guard one level up.)
+FAILED=""
+run_module() {
+  if ( set -e; "$SCRIPT_DIR/$1/install.sh" ); then return 0; fi
+  FAILED="$FAILED $1"
+  echo "bootstrap: WARNING: $1 module failed; continuing." >&2
+}
+
+run_module zsh
+run_module git
 # Runs before bin/ so the kind install gate can see the rootful daemon.
-"$SCRIPT_DIR/docker/install.sh"
-"$SCRIPT_DIR/bin/install.sh"
+run_module docker
+run_module bin
 # Provides npx, which opencode needs to spawn the npm-based MCP servers in
 # mcp-config/. Without it every MCP server silently fails to start.
-"$SCRIPT_DIR/node/install.sh"
-"$SCRIPT_DIR/ansible/install.sh"
+run_module node
+run_module ansible
 # Runs last: needs rootless Docker already up (started at boot) so it can
 # delegate cgroups to it. No-ops where that does not apply.
-"$SCRIPT_DIR/docker-rootless-cgroup/install.sh"
+run_module docker-rootless-cgroup
+
+if [ -n "$FAILED" ]; then
+  echo "" >&2
+  echo "bootstrap: WARNING: these modules did NOT complete:$FAILED" >&2
+  echo "bootstrap: everything else was applied. Fix the cause and re-run." >&2
+  exit 1
+fi
+echo "bootstrap: all modules applied." >&2