v2.14.5 — Docker cap fail-safe handles spawn errors (A80)

Completes the Docker resource-cap fail-safe: a cap the rootless daemon rejects makes the container exit immediately (a Supervisor "spawn error"), which is now caught and treated like a failed start — the cap is recorded-but-not-enforced and the container is brought back without it, so the site never goes down. Found and fixed via live validation on the Rocky host.