doos 1.0.0: images, size cap, subuid ids, working apt in host mode

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/sandbox.hpp

@@ -7,6 +7,8 @@
 
 namespace doos {
 
+class Cgroup;
+
 // Runs a command inside a container: starts the namespaces if the container is
 // stopped, joins them if it is already running. Returns the command's exit code.
 class Sandbox {
@@ -18,6 +20,7 @@ public:
 
 private:
     int start(FileLock& lock);
+    int watch(pid_t child, Cgroup* cgroup);
     int join(pid_t initPid, FileLock& lock);
 
     Container container_;