v2.14.3 — Docker cap fail-safe (A80)

A per-vhost resource cap must never take a running site down. On a host whose rootless Docker lacks cgroup v2 CPU/memory delegation, docker run --cpus/--memory is rejected and the container won't start; applying such a cap now clears it, restarts the container without it, and reports that this host's rootless Docker can't enforce caps — instead of leaving the site down. Found by live validation.