fix(docker-outside-of-docker): check DOCKER_GID on container start - #1749

Problem

DOCKER_GID was computed once in install.sh at feature install time and baked into the generated /usr/local/share/docker-init.sh through heredoc expansion. This causes several problems when the container starts:

1. Stale GID. The init script compares the socket GID against the docker group GID from build time, not the one in the running container. If the group GID differs at runtime, the comparison is wrong.
2. Unnecessary socat proxy. When the socket GID already matched the docker group GID, the condition SOCKET_GID != DOCKER_GID was false and execution fell through to the else branch. That branch replaced docker.sock with a socat proxy even though nothing needed fixing.
3. Fragile GID collision check. grep -E ".+:x:${SOCKET_GID}" /etc/group is not anchored to the GID field:
   • 100 also matches a group with GID 1000
   • it can match other fields of the line
   • it prints the matched line into the output

Changes

• Removed the build-time DOCKER_GID="$(grep -oP ...)" from install.sh.
• docker-init.sh now reads the docker GID at container start:

  DOCKER_GID="$(getent group docker | cut -d: -f3)"

• Reworked the branching logic:
  • SOCKET_GID == DOCKER_GID → log it and do nothing (no proxy, no group changes)
  • SOCKET_GID != 0 and no group with that GID exists → groupmod --gid "${SOCKET_GID}" docker
  • otherwise (root-owned socket or GID already taken by another group) → fall back to the socat proxy, as before
• Replaced the grep on /etc/group with getent group "${SOCKET_GID}". It does an exact lookup by GID and also works with NSS sources other than /etc/group.