v2.14.4 — Docker cap honest degradation (A80)

Refines v2.14.3: when a host's rootless Docker can't enforce a CPU/memory cap (no cgroup v2 delegation), the cap is no longer silently removed. It stays recorded, the container runs without it, and the panel reports it as "recorded but not enforced on this host" — persistent, honest visibility. Re-attempted on each change in case delegation gets enabled.