feat(macos): spike rootless Docker inside bottles

Add an opt-in docker_access path that layers rootless Docker tooling onto the selected agent image, starts the daemon only after registration, and retains the existing outer network and capability boundary. Include fail-closed bootstrap checks plus a live-Mac Compose/security acceptance test.\n\nRefs #392.

bot_bottle/backend/macos_container/rootless-docker-init.sh

@@ -0,0 +1,57 @@
+#!/bin/sh
+set -eu
+
+uid="$(id -u)"
+if [ "$uid" -eq 0 ]; then
+    echo "refusing to run rootless Docker as root" >&2
+    exit 1
+fi
+
+for command in dockerd-rootless.sh rootlesskit slirp4netns newuidmap newgidmap docker; do
+    command -v "$command" >/dev/null 2>&1 || {
+        echo "missing rootless Docker prerequisite: $command" >&2
+        exit 1
+    }
+done
+
+grep -q "^$(id -un):.*:65536$" /etc/subuid || {
+    echo "missing 65536-entry subordinate UID range for $(id -un)" >&2
+    exit 1
+}
+grep -q "^$(id -gn):.*:65536$" /etc/subgid || {
+    echo "missing 65536-entry subordinate GID range for $(id -gn)" >&2
+    exit 1
+}
+
+export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp/bot-bottle-docker-run}"
+mkdir -p "$XDG_RUNTIME_DIR" "$HOME/.docker"
+chmod 700 "$XDG_RUNTIME_DIR"
+
+# Docker uses this config for build and child-container proxy injection.  The
+# token-bearing proxy URL is already available to the agent; persisting it
+# inside this disposable VM does not broaden its authority.
+python3 - <<'PY'
+import json
+import os
+from pathlib import Path
+
+proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy", "")
+no_proxy = os.environ.get("NO_PROXY") or os.environ.get("no_proxy", "")
+config = {"proxies": {"default": {
+    "httpProxy": proxy,
+    "httpsProxy": proxy,
+    "noProxy": no_proxy,
+}}}
+path = Path.home() / ".docker" / "config.json"
+path.write_text(json.dumps(config), encoding="utf-8")
+path.chmod(0o600)
+PY
+
+if docker info >/dev/null 2>&1; then
+    exit 0
+fi
+
+log=/tmp/bot-bottle-rootless-docker.log
+nohup dockerd-rootless.sh \
+    --storage-driver=fuse-overlayfs \
+    >"$log" 2>&1 </dev/null &