doos 1.0.0: images, size cap, subuid ids, working apt in host mode

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/cgroup.hpp

@@ -0,0 +1,30 @@
+#pragma once
+#include <sys/types.h>
+
+#include <filesystem>
+#include <memory>
+#include <string>
+
+namespace doos {
+
+// One cgroup v2 leaf per running container, under the cgroup delegated to the user's systemd manager.
+// Used to freeze a container that hit its size cap (freezing needs no controller). Best effort:
+// create() returns null when delegation is absent, and the caller must say so.
+class Cgroup {
+public:
+    static std::unique_ptr<Cgroup> create(const std::string& name, std::string& whyNot);
+    ~Cgroup();
+    Cgroup(const Cgroup&) = delete;
+    Cgroup& operator=(const Cgroup&) = delete;
+
+    void add(pid_t pid) const;
+    void freeze(bool on) const;
+    bool frozen() const { return frozen_; }
+
+private:
+    explicit Cgroup(std::filesystem::path dir) : dir_(std::move(dir)) {}
+    std::filesystem::path dir_;
+    mutable bool frozen_ = false;
+};
+
+}  // namespace doos