feat: implement rootless Docker with container management support

Docker Infrastructure:
- Added proper user namespace mapping in Dockerfile.alpine
- Created 'builder' user with host UID/GID mapping at build time
- Removed runtime user mapping (now handled in Dockerfile)
- Set up Rust environment for mapped user instead of root
- Fixed config mount consistency (removed :ro flags for real-time sync)

Container Management:
- Added 15 essential cgroup modules to modules-essential.list
- Complete cgroups v1 and v2 support for container orchestration
- Process control: cgroup_pids, cgroup_freezer, cgroup_cpuset
- Memory management: memcg, hugetlb_cgroup
- Network control: net_cls_cgroup, net_prio_cgroup
- Device access: cgroup_device, devices_cgroup
- Advanced features: cgroup_bpf, cgroup_perf_event, cgroup_debug

Environment Updates:
- Updated RFS Dockerfile to Alpine 3.22 for consistency
- Ensured proper /build directory permissions for mapped user

This enables true rootless operation with full container management
capabilities, fixing permission issues and enabling Zero-OS container
orchestration with complete resource control.

configs/modules-essential.list

@@ -40,3 +40,20 @@ overlay
 # Storage subsystem (essential only)
 scsi_mod
 sd_mod
+
+# Control Groups (cgroups v1 and v2) - essential for container management
+cgroup_pids
+cgroup_freezer
+cgroup_perf_event
+cgroup_device
+cgroup_cpuset
+cgroup_bpf
+cgroup_debug
+memcg
+blkio_cgroup
+cpu_cgroup
+cpuacct
+hugetlb_cgroup
+net_cls_cgroup
+net_prio_cgroup
+devices_cgroup