v1.3.0

Adds a shims subcommand that reaps orphaned containerd-shim-runc-v2 processes — shims whose container is already gone, which cannot be reached through the Engine API (the daemon returns 404) and which each hold roughly 5 MiB until the host reboots.

Added

• docker-reaper shims signals a process only once it is in the reaper's own PID namespace, /proc/<pid>/exe names containerd-shim-runc-v2, its 64-hex container id is absent from the full container list, and it is older than --min-age. The last two are re-confirmed after --settle, and identity is checked once more immediately before the SIGKILL escalation. Removal is SIGTERM to the batch, one shared --grace window, then SIGKILL.
• Local-only by design: it reads this machine's process table, so it exits if DOCKER_HOST or DOCKER_CERT_PATH is set, and needs root to signal.

Full rationale and verification: #168