docker: install from the docker-ce repo on RHEL-family hosts

bootstrap failed outright on Oracle Linux: docker/install.sh piped
get.docker.com to sh, and that script allowlists distros by /etc/os-release
ID, so it aborted with "ERROR: Unsupported distribution 'ol'".

On a distro it does recognize, the convenience script only adds the repo and
installs the packages -- exactly what install_rhel() now does directly. Doing
it ourselves drops the allowlist, so every EL rebuild (Oracle, Rocky, Alma,
CentOS, RHEL) goes through one code path instead of needing to be enumerated.
Debian-family still uses get.docker.com. containerd.io needs --allowerasing to
replace the runc that Oracle Linux ships.

Also stop one failed module from killing the whole run: modules were bare
calls under `set -eu`, so docker/'s exit meant bin/, node/ and ansible/
silently never ran -- an unsupported distro string left the box with no CLIs,
no npx and no ansible. run_module warns and continues, then bootstrap exits
non-zero with a summary of what failed. Same guard 35befbe added for
individual tools in bin/install.sh, one level up.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker/install.sh

@@ -3,10 +3,10 @@
 # invoking user talk to it without sudo.
 #
 # What it does:
-#   1. Installs Docker Engine via Docker's official convenience script
-#      (get.docker.com — supports both RHEL- and Debian-family distros and
-#      sets up the upstream package repo). Skipped when `docker` is already
-#      installed.
+#   1. Installs Docker Engine from Docker's upstream package repo. Skipped when
+#      `docker` is already installed. Debian-family hosts go through Docker's
+#      convenience script (get.docker.com); RHEL-family hosts wire up the
+#      docker-ce repo directly — see install_rhel() for why.
 #   2. Enables and starts the service (systemd hosts only).
 #   3. Adds the invoking user to the `docker` group so the daemon socket is
 #      usable without sudo. Takes effect at next login.
@@ -18,8 +18,66 @@
 # Idempotent and safe to re-run. Uses sudo.
 set -eu
 
+SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)"
+REPO_ROOT="$(dirname -- "$SCRIPT_DIR")"
+
+# shellcheck source=../lib/os-detect.sh
+. "$REPO_ROOT/lib/os-detect.sh"
+
 say() { printf '%s\n' "$*" >&2; }
 
+DOCKER_PKGS="docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin"
+
+# install_rhel — install docker-ce from Docker's EL repo.
+#
+# WHY NOT get.docker.com: the convenience script allowlists distros by
+# /etc/os-release ID and aborts on anything it does not recognize —
+# "ERROR: Unsupported distribution 'ol'" on Oracle Linux, and the same for
+# other EL rebuilds it has not enumerated. On a match it does nothing more
+# than what this function does: add the repo, then install the packages.
+# Wiring the repo up directly drops the allowlist, so every EL rebuild
+# (Oracle, Rocky, Alma, CentOS, RHEL) installs from one code path.
+#
+# The repo URL is keyed on $releasever/$basearch, which dnf expands per host,
+# so EL9 and EL10 both resolve without a version table here.
+install_rhel() {
+  say "docker: adding Docker CE repo (EL \$releasever/\$basearch)..."
+  sudo tee /etc/yum.repos.d/docker-ce.repo >/dev/null <<'REPO'
+[docker-ce-stable]
+name=Docker CE Stable - $basearch
+baseurl=https://download.docker.com/linux/centos/$releasever/$basearch/stable
+enabled=1
+gpgcheck=1
+gpgkey=https://download.docker.com/linux/centos/gpg
+REPO
+  # --allowerasing: containerd.io conflicts with the distro's own runc/containerd
+  # on EL rebuilds that ship them (Oracle Linux does). Let dnf swap them out
+  # rather than dead-end on the conflict.
+  if command -v dnf >/dev/null 2>&1; then
+    # shellcheck disable=SC2086
+    sudo dnf install -y --allowerasing $DOCKER_PKGS
+  else
+    # shellcheck disable=SC2086
+    sudo yum install -y --allowerasing $DOCKER_PKGS
+  fi
+}
+
+# install_debian — Docker's convenience script; it supports every Debian-family
+# distro this repo targets and sets up the apt repo and keyring.
+install_debian() {
+  say "docker: installing Docker Engine via get.docker.com..."
+  tmp="$(mktemp)"
+  if command -v curl >/dev/null 2>&1; then
+    curl -fsSL https://get.docker.com -o "$tmp"
+  elif command -v wget >/dev/null 2>&1; then
+    wget -qO "$tmp" https://get.docker.com
+  else
+    say "docker: need curl or wget"; rm -f "$tmp"; return 1
+  fi
+  sudo sh "$tmp"
+  rm -f "$tmp"
+}
+
 # --- skip on rootless-Docker hosts -------------------------------------------
 if command -v docker >/dev/null 2>&1 &&
    docker info -f '{{println .SecurityOptions}}' 2>/dev/null | grep -q 'name=rootless'; then
@@ -31,17 +89,11 @@ fi
 if command -v docker >/dev/null 2>&1; then
   say "docker: engine already installed ($(docker --version 2>/dev/null || echo 'version unknown'))."
 else
-  say "docker: installing Docker Engine via get.docker.com..."
-  tmp="$(mktemp)"
-  if command -v curl >/dev/null 2>&1; then
-    curl -fsSL https://get.docker.com -o "$tmp"
-  elif command -v wget >/dev/null 2>&1; then
-    wget -qO "$tmp" https://get.docker.com
-  else
-    say "docker: need curl or wget"; exit 1
-  fi
-  sudo sh "$tmp"
-  rm -f "$tmp"
+  case "$(detect_pkg_family)" in
+    rhel)   install_rhel ;;
+    debian) install_debian ;;
+    *)      say "docker: unsupported/undetected OS family; install Docker manually."; exit 1 ;;
+  esac
 fi
 
 # --- 2. enable + start the service (systemd only) ----------------------------