Detect Docker without spawning grep

[OskarEichler]

Summary

OS::Underlying.docker? currently shells out to grep and only recognizes cgroup paths containing docker. Docker using cgroup v2 can expose root membership such as 0::/, so the predicate returns false even inside the container; every call also creates a subprocess.

This checks /.dockerenv first, streams cgroup membership as a fallback, and returns false when Linux metadata is unavailable. It intentionally remains Docker-specific and does not classify Podman.

Verification

• added focused regressions for cgroup-v2, cgroup markers, and unavailable metadata
• Ruby 4.0.6: 39 examples, 0 failures
• combined candidates: 42 examples, 0 failures on Ruby 4.0.6 and 3.2.11
• syntax and diff checks pass

Changing non-Linux or unavailable results from nil to false makes the predicate consistently boolean.