Diag: docker socket permission denied, fix group membership not chmod

# Diag: permission denied on the Docker socket

**Symptom (exact):** agent log: `permission denied` opening `/var/run/docker.sock`. Container metrics missing, Docker check failing, everything else fine.

**Likely causes:** (a) agent user not in the docker group (host install), (b) socket not mounted into the agent container, (c) socket mounted read-only or with wrong perms.

**Confirm:**

1. Host: `groups dd-agent` (or the agent user). Missing `docker` is the answer.
2. As the agent user, try reading the socket. Permission denied reproduces it exactly.
3. Container: inspect the agent container mounts. No `/var/run/docker.sock` mount means the agent cannot see Docker at all, different symptom (no error, just no containers).

**Fix:**

- Host: add the agent user to the docker group and restart the agent (group membership needs a fresh process).
- Container: mount the socket into the agent container per the docs.
- Do not chmod 777 the socket. Group membership is the fix; world-writable docker socket is a security incident.

**Verify:** Docker check OK in `agent status`, containers appear in Infrastructure, Containers. If you use containerd/crio instead of Docker, the socket path differs: configure the right runtime socket, not the Docker one.