feat(installer): provision Docker for the daily user during the admin window (docker-users + autostart + sized .wslconfig)

[LukasWodka]

Why

Hospital/enterprise reality: the researcher gets a temporary admin window (or an IT admin runs the install), and elevation is revoked afterwards. Today Docker Desktop only auto-adds the installing user to docker-users, autostart is a printed Hint, and the WSL memory budget is a printed Hint — so the researcher's standard account can end up with a broken Docker, a cluster that doesn't come back after reboot, and a 50%-of-RAM VM that OOMs training. We hand-fix this per site today (net localgroup docker-users <user> /add, autostart, .wslconfig); the installer runs elevated and should just do it.

Where

scripts/install-k8s.ps1 (v1.9.6): autostart hint L2138, memory hints L2351–2356; no docker-users handling exists. Related: the Linux prepare-host admin step (#381) and its CLI wrapper (tracebloc/cli#394) — this is the Windows peer, see tracebloc/backend#1178 / #1179.

Scope (all during the elevated run, with consent)

• Ask for / accept the daily username when the elevated user differs (parameter + prompt); net localgroup docker-users <user> /add.
• Enable Docker Desktop autostart for that user ("start when you sign in") — settings.json autoStart or the per-user Run key.
• Write %UserProfile%\.wslconfig [wsl2] memory=<sized from the #393 training budget, capped at physical − 4 GB> for the daily user + orchestrate wsl --shutdown and a Docker restart.
• Print a "configured for " summary so IT can review what changed.

Acceptance criteria

• Standard (non-admin) user signs in the next day: Docker starts, cluster auto-recovers, Docker budget is training-capable — zero admin actions needed.

[LukasWodka]

Cross-OS audit note — this ticket now has siblings; keep this one Windows-scoped:

• Linux sibling fix(installer): docker-group grant only fires on fresh Docker installs; sudo runs root-own the data dir (SUDO_USER never read) #427: the docker-group grant only fires on fresh Docker installs (pre-installed-Docker hosts dead-end at "log out and back in", which can't help), and sudo runs grant root + root-own ~/.tracebloc/kubeconfig (SUDO_USER is never read).
• macOS sibling feat(installer): macOS lifecycle — autostart, Docker Desktop first-launch (privileged helper), managed-Mac path #430: no autostart mechanism exists at all (no LaunchAgent; headless colima never survives reboot) and Docker Desktop's privileged-helper first-launch dialog is unhandled.

Shared design across all three: one "provision for a named daily user" concept — TB_PREPARE_USER already exists in prepare-host (scripts/lib/setup-linux.sh L813/L847) and should be the common parameter name.

[shujaatTracebloc]

Done in #493 (squash-merged to develop as 0b56fcf). Shipped Set-DailyUserProvisioning (docker-users state-query verify, autostart, merge-preserving sized .wslconfig) plus 4 rounds of Bugbot hardening (merge-preserve, null-profile/RAM-unknown/write-throw summary notes, -DailyUser elevation forwarding, sanitized prompt). Closing manually since the repo default branch is main (auto-close doesn't fire on develop merges).