core: GPU containers, bind sub-paths, and stop containers on unit stop

- container launcher: `gpus:` passes through as docker `--gpus`.
- requires: `path:` is appended to the bound URL, for consumers that want a
  sub-path as their base (e.g. an OpenAI-compatible server's /v1).
- container services now get `ExecStop=-docker stop wildpc-<name>`. SIGTERM
  only reached the `docker run` client, so a stop/restart left the container
  running unsupervised and holding its name, and the next start failed with
  a name conflict until systemd gave up.

core/src/wildpc_core/manifest.py

@@ -97,6 +97,9 @@ class RunContainer(LaunchBase):
     # tmpfs mounts (e.g. ["/var/run/postgresql"]) for image runtime dirs that must
     # be writable when the container runs as a non-default uid.
     tmpfs: list[str] = Field(default_factory=list)
+    # GPUs to hand the container (docker `--gpus`), e.g. "all" or "device=0".
+    # None → no GPU access.
+    gpus: str | None = None
 
 
 class RunNode(LaunchBase):
@@ -308,6 +311,9 @@ class Requirement(BaseModel):
     kind: Literal["system", "deployment", "tool"] = "deployment"
     ref: str
     bind: str | None = None
+    # Appended to the target's URL when binding — for a consumer that wants a
+    # sub-path of it (e.g. an OpenAI-compatible server's "/v1") as its base URL.
+    path: str | None = None
 
 
 # ---------------------