core: GPU containers, bind sub-paths, and stop containers on unit stop

- container launcher: `gpus:` passes through as docker `--gpus`.
- requires: `path:` is appended to the bound URL, for consumers that want a
  sub-path as their base (e.g. an OpenAI-compatible server's /v1).
- container services now get `ExecStop=-docker stop wildpc-<name>`. SIGTERM
  only reached the `docker run` client, so a stop/restart left the container
  running unsupervised and holding its name, and the next start failed with
  a name conflict until systemd gave up.

docs/registry.md

@@ -274,7 +274,7 @@ Nested launch spec, discriminated union on `launcher`:
 |----------|--------|------------|
 | `python` | `uv run --project <source> --no-dev <program>` | `program`, `args` |
 | `command` | `which(argv[0])` → resolved path | `argv` |
-| `container` | `docker`/`podman` `run` | `image`, `command`, `ports`, `volumes` |
+| `container` | `docker`/`podman` `run` (+ `ExecStop=docker stop`) | `image`, `command`, `ports`, `volumes`, `gpus` |
 | `compose` | `docker compose -p <project> -f <file> up` (+ `ExecStop=down`) | `file`, `project_name` |
 | `node` | `package_manager run script` | `script`, `package_manager` |
 

docs/relationships.md

@@ -51,6 +51,9 @@ requires:
   - { ref: litellm, bind: LITELLM_URL }   # bind: project the target's URL into env
 ```
 
+`path` is appended to the bound URL, for a consumer that wants a sub-path as its
+base (e.g. `{ ref: vllm, bind: VLLM_API_BASE, path: /v1 }`).
+
 A **program**'s host-package preconditions stay on the program as
 `system_dependencies` (a plain list of package names); the model synthesizes the
 `{kind: system}` requirements from it for the `functional?` check. This split keeps