Remove the rootless Docker cert-generator mapping #1053

Problem

LilRAE does not support rootless Docker. #1174 refuses rootless and userns-remap daemons by name. The rootless experiment still left rootless-specific code on dev:

• src/aptl/core/certs.py probes the daemon with _docker_is_rootless() (~330). On a rootless daemon, _container_cert_user() (~315) runs the Wazuh cert generator as 0:0 ((0, 0) if rootless). fix(certs): run the Wazuh cert generator as container-root under rootless Docker #1044 added this. tests/test_certs.py (~228) tests it.
• The feat!: run systemd substrate nodes without host cgroup or added privilege #1174 refusal runs only when a selected node needs writable cgroups (_compose_owned_start.py ~157, _compose_base_substrate.py ~110). _step_generate_certs runs before that gate, so the cert generator can still reach a rootless daemon.

Audit of the other rootless references on dev (5828f62):

• Memlock: _DEFAULT_IMAGE_NODE_ULIMITS (src/aptl/core/deployment/_compose_node_generation.py ~186) came from feat(scenario): declare TechVault content in the SDL via the env-pack (#875) #908 on 2026-08-03, before the experiment. fix: realize SDL runtime authority as authored #1108 only moved related text. It is not rootless-specific. Keep it.
• _docker_endpoint_binding.py (~41) and tests/test_raes_runtime_orchestration.py (~1054) use a rootless socket as the example for the unix:// DOCKER_HOST support from feat(deployment): honor a unix:// DOCKER_HOST for the local Docker control endpoint #1039. The behavior is general. Keep it and change only the wording.
• src/aptl/appliance/seat/ uses a rootless QEMU network namespace (slirp4netns) for VM seats. This is not rootless Docker. Keep it.
• Teardown comments and tests that mention "a rootless lab" describe a past failure. They need no change.
• No user doc describes rootless Docker support. ADR-059 and the Realize authored spawn-template images as written #974 preflight mention rootless only as history. The Review APTL readiness for the LilRAE personal backend migration #962 readiness review lists rootless Docker as an option to assess.

Scope

• Remove _docker_is_rootless(), the rootless parameter and the (0, 0) if rootless branch from src/aptl/core/certs.py. Remove their tests.
• Change the rootless wording in the feat(deployment): honor a unix:// DOCKER_HOST for the local Docker control endpoint #1039 docstring and test name to a generic non-default unix:// socket.
• Make a rootless daemon fail with a named reason before the cert generator runs.

Done when

• src/aptl has no rootless-specific branch outside the feat!: run systemd substrate nodes without host cgroup or added privilege #1174 refusal.
• Cert ownership on rootful native Linux and on Docker Desktop does not change.
• On a rootless daemon, aptl lab start fails with a named reason before any mutation, for every scenario.
• The explicit daemon identity from feat(deployment): honor a unix:// DOCKER_HOST for the local Docker control endpoint #1039 and the port routing from feat(mcp): resolve MCP client host ports from the lab's remapped publications #1047 do not change. LilRAE never redirects an explicitly selected endpoint to a different daemon.
• Relevant tests and pre-commit pass.
• A clean stop and start on a rootful host reaches full readiness.

Out of scope

• Host cleanup on the dev box. This is local operations, not repository work.

Related

• feat!: run systemd substrate nodes without host cgroup or added privilege #1174, fix(certs): run the Wazuh cert generator as container-root under rootless Docker #1044, feat(deployment): honor a unix:// DOCKER_HOST for the local Docker control endpoint #1039, feat(mcp): resolve MCP client host ports from the lab's remapped publications #1047, fix: realize SDL runtime authority as authored #1108