Rootless containers and managed TLS

The container engine's full mode (host bridge, veth pairs, NAT, inter-container networking) now runs for a non-root launcher: install-caps.sh grants cap_net_admin,cap_sys_admin to the binary once, the Docker-daemon privilege model but daemonless, and every later run by any user gets full networking. True-rootless mode adds inbound port publishing, AppArmor userns profiles and cgroup delegation (box-validated on cgroups v2), and compose service DNS resolves container names in capability and rootless mode.

On the TLS side, kern ships an ACME v2 client (net.acme) that generates the PKCS#10 CSR and drives the Let's Encrypt exchange, and serve_tls_managed(server, cert_path, key_path) serves HTTPS from the resulting files, with reload_tls_cert to pick up a renewal without dropping the listener. HTTPS without a reverse proxy in front of it; the renewal loop is yours to schedule.