core: GPU containers, bind sub-paths, and stop containers on unit stop

- container launcher: `gpus:` passes through as docker `--gpus`.
- requires: `path:` is appended to the bound URL, for consumers that want a
  sub-path as their base (e.g. an OpenAI-compatible server's /v1).
- container services now get `ExecStop=-docker stop wildpc-<name>`. SIGTERM
  only reached the `docker run` client, so a stop/restart left the container
  running unsupervised and holding its name, and the next start failed with
  a name conflict until systemd gave up.

docs/registry.md

@@ -274,7 +274,7 @@ Nested launch spec, discriminated union on `launcher`:
 |----------|--------|------------|
 | `python` | `uv run --project <source> --no-dev <program>` | `program`, `args` |
 | `command` | `which(argv[0])` → resolved path | `argv` |
-| `container` | `docker`/`podman` `run` | `image`, `command`, `ports`, `volumes` |
+| `container` | `docker`/`podman` `run` (+ `ExecStop=docker stop`) | `image`, `command`, `ports`, `volumes`, `gpus` |
 | `compose` | `docker compose -p <project> -f <file> up` (+ `ExecStop=down`) | `file`, `project_name` |
 | `node` | `package_manager run script` | `script`, `package_manager` |