install the rootless docker prerequisites with docker itself

Reported from a member's daemon failing: "rootless Docker needs these packages on
the host: uidmap".

They were being installed — but only inside branch [2] "rootless Docker for
<owner>" in section 22. The owner's choice is not the only one that matters: every
Developer account the platform provisions gets its own rootless daemon whatever the
owner picked for themselves. So on a machine where the owner chose the docker
group, the host never got them and every member's daemon failed.

Moved into install_docker_engine, so they arrive with Docker rather than with one
particular answer to a question about the owner.

Three packages, not the one in the error. checkDockerPrerequisites in
os-user-docker.ts is the authority and wants uidmap (newuidmap, newgidmap) AND
docker-ce-rootless-extras (dockerd-rootless-setuptool.sh); dbus-user-session is
what keeps a member's systemd --user alive without a login session. rootless-extras
is only RECOMMENDED by docker-ce — installed by default, so usually there by luck,
and absent on any host configured with --no-install-recommends. Named explicitly.

Reproduced on this machine while checking: rootless-extras present via Recommends,
uidmap absent, newuidmap and newgidmap missing. Exactly the reported failure, on a
box that chose the docker group.

The rootless branch still installs uidmap and dbus-user-session behind its
pkg_is_installed guard. Redundant now, kept deliberately: it is the only thing that
fixes a machine whose Docker was installed by an older run of this script.

Verified: bash -n on both files, and all three packages present in the noble
archive.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup/machine-setup/lib/docker.sh

@@ -72,7 +72,30 @@ install_docker_engine() {
     >/etc/apt/sources.list.d/docker.list
 
   pkg_refresh >/dev/null
-  pkg_install_now docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+
+  # ── The rootless prerequisites go in HERE, not in the rootless branch ──
+  #
+  # They used to be installed only when the owner picked "[2] rootless Docker for
+  # me" in section 22. But the OWNER's choice is not the only one that matters:
+  # every Developer account the platform provisions gets its own rootless daemon,
+  # whatever the owner picked for themselves. So on a machine where the owner chose
+  # the docker group, the host never got these and every member's daemon failed
+  # with `rootless Docker needs these packages on the host: uidmap`.
+  #
+  # `src/servers/os-user-docker.ts` → checkDockerPrerequisites is the authority on
+  # this list, and it wants both:
+  #
+  #   uidmap                      /usr/bin/newuidmap, /usr/bin/newgidmap
+  #   docker-ce-rootless-extras   /usr/bin/dockerd-rootless-setuptool.sh
+  #
+  # docker-ce only RECOMMENDS rootless-extras. That is installed by default, so it
+  # is usually there by luck — and is not on a host configured with
+  # --no-install-recommends. Named explicitly so it does not depend on that.
+  #
+  # dbus-user-session is what lets a member's systemd --user survive without a
+  # login session, which is how the daemon stays up.
+  pkg_install_now docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin \
+    docker-ce-rootless-extras uidmap dbus-user-session
 }
 
 # A shared network so containers from different compose files can reach each