put rootless docker back, behind the developer gate

Uncommented at all three sites: the call and import in provisionOsAccount, the
~/.local/dockers bind-mount directory in confineUserTree, and the DOCKER_HOST block in
the member zshrc.

Not restored unconditionally, which is how it was before. It now sits behind the same
Developer check as the Postgres role — the gate that prompted disabling it in the first
place. So rolePermitsDatabase is renamed rolePermitsDevTools: it gates two things now
and a name saying "database" while deciding whether you get containers is the kind of
comment that goes stale silently.

~/.local/dockers is created for EVERY account rather than only Developers. It is two
install calls, and confineUserTree is the function that places the layout, not the one
that knows who is a Developer — so a member promoted later finds it already correct.

Postgres role work is untouched and still in place.

Verified: transpiles.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/shell-skel/zshrc

@@ -124,9 +124,14 @@ fi
 # like Postgres is not installed rather than like it is one flag away.
 
 # ── Docker ──
-# Officer no longer provisions a rootless daemon per account (2026-08-13) — a Postgres role covers the
-# case it was really there for, at none of the cost. Kept because it costs one stat and does the right
-# thing if you install rootless Docker yourself.
+# Your own rootless daemon, if Officer provisioned one — Developer accounts get one. Containers you start
+# run as your account in your own user namespace: root inside them is you outside them, and you cannot see
+# anyone else's containers.
+#
+# Bind mounts belong under ~/.local/dockers. A container's inner uid is neither you nor Officer, so it
+# needs traversal that only that directory grants; elsewhere in your home it will be denied.
+#
+# Set from $XDG_RUNTIME_DIR rather than a hard-coded uid so this line is the same in every account's file.
 if [ -S "${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/docker.sock" ]; then
   export DOCKER_HOST="unix://${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/docker.sock"
 fi