Multi-namespace REC capture
REC auto-detect now opens a capture socket inside each discovered public-facing container's namespace instead of a single host capture. New REC_MAX_NAMESPACES (default 16) caps the count; REC_EXCLUDE_CONTAINERS opts containers out. Legacy REC_NS_CONTAINER mode is unchanged.