fix(rootless_docker): widen subid range by adding the missing tail

[jcardozo-eth]

What

Widen the runner's subordinate UID/GID range additively: add only the missing tail as a further contiguous range with a pure usermod --add, instead of deleting and re-adding the range in one usermod call.

Why

usermod runs a running-process guard on --del-subuids/--del-subgids, and the runner user always has a live session (the lingering systemd --user manager), so the delete-and-re-add widen failed on exactly the converged, running hosts it targets: the widen exited 8, the daemon restart was skipped, and the apply errored. A pure --add is not guarded and succeeds on a live user. No released version is affected; the widen is unreleased behaviour.

How

• Detect a contiguous block anchored at the declared start (fold the subid fact's ranges) and, when it is narrower than subid_count, add only the missing tail. The existing lower ranges stay as an untouched prefix, and rootlesskit maps every range, so the effective width is their sum.
• Extend detection so a contiguous-from-start set summing to the count is satisfied and silent, so a widened host no longer warns on every apply; gapped, foreign-start, or overlapping ranges still warn or fail loud at the preflight.
• Guard the widen with an awk onlyif re-asserting the covered width, so a host changed since fact collection is skipped and the widen no-ops once the sum reaches the count.

Verification

• just check green: puppet validate, lint, 148 examples/0 failures, docs-check.
• Failing-first: the updated and new specs fail against the pre-fix manifest (5 failures) and pass with the fix. New cases cover two contiguous ranges summing to the count (silent), a raised count adding a further tail, and a gapped set still advising.
• Pending before merge: the greenfield re-cert on a live host must confirm the two-line range maps to the full effective width after the daemon restart (docker info, /proc/<dockerd-pid>/uid_map), not just apply exit 0.

Closes #37

[jcardozo-eth]

Greenfield re-cert passed on a live Ubuntu 22.04 host with the rootless daemon up and a lingering systemd --user session present, the exact condition the old delete-and-re-add widen failed on. The run, step by step:

1. Deliver the fix to the host (module re-pinned to the PR commit) and confirm the additive-tail code is in the applied tree.
2. Force the narrow state with the daemon live: set gitlab-runner:231072:65536 in /etc/subuid and /etc/subgid, daemon and user session still running.
3. Preview (--noop): plans both widens plus the daemon restart (2 events), with no --del.
4. Apply for real: both widens run a pure usermod --add-subuids 296608-396607 and exit successfully (apply exit 2, changes applied), where the previous del+add exited 8 and the apply exited 4. /etc/subuid and /etc/subgid become two contiguous entries summing to the declared 165536.
5. Verify the effective width after the restart: the notified daemon restart re-creates the user namespace, and uid_map/gid_map map both contiguous ranges as one full-width span:

   0      2000     1
   1      231072   65536
   65537  296608   100000
   

   docker info reports a healthy rootless daemon (Server 29.6.2) and hello-world runs. The rootlesskit multi-line edge ([rootlesskit:parent] error: failed to setup UID/GID map [...] failed: newuidmap: write to uid_map failed: Invalid argument (when /etc/subuid has multiple lines for the user) rootless-containers/rootlesskit#476) does not apply here: it needs a range colliding with the user's own uid, not a contiguous tail well above it.
6. Confirm idempotent and silent: re-applying on the two-line satisfied state is a no-op (exit 0, no widen, no advisory), confirming the detection extension on a real host.