v0.6.20

kern 0.6.20

One fix, found on a Raspberry Pi 5 two hours after 0.6.19 shipped.

The `docker` shim was broken through a symlink, for every non-root user.
Installed the way the README documents:

  ln -s "$(command -v kern)" ~/.local/bin/docker
  docker run --rm alpine echo hi
  -> error: usage: kern run: unknown flag (put `--` before the command)

kern re-execs itself under `systemd-run --scope` to apply cgroup caps, and that
path is taken by an ordinary user, not by root. The re-exec replayed the argv
the user TYPED and located the binary with current_exe(), which resolves the
symlink: the second pass received argv[0] = kern, no longer recognised itself
as the shim, and handed untranslated docker syntax to kern's own `run` verb.

Two independent losses that combine only through a symlink. As a copy named
`docker` it worked, which is why every check run before a board ran it as a
real user had passed.

The re-exec now replays the argv kern DECIDED. `kern box --restart` had the
same defect and worse consequences: it freezes the argv into a systemd unit, so
docker syntax would have been written into a file that fails at every boot.

Verified on the Pi 5, the Jetson Orin Nano and the Arduino UNO Q: 17/17 each,
symlink and copy, `--device` still refused by name. 637 Rust tests, 61 Python,
50 Node, clippy clean.