core: GPU containers, bind sub-paths, and stop containers on unit stop

- container launcher: `gpus:` passes through as docker `--gpus`.
- requires: `path:` is appended to the bound URL, for consumers that want a
  sub-path as their base (e.g. an OpenAI-compatible server's /v1).
- container services now get `ExecStop=-docker stop wildpc-<name>`. SIGTERM
  only reached the `docker run` client, so a stop/restart left the container
  running unsupervised and holding its name, and the next start failed with
  a name conflict until systemd gave up.

docs/relationships.md

@@ -51,6 +51,9 @@ requires:
   - { ref: litellm, bind: LITELLM_URL }   # bind: project the target's URL into env
 ```
 
+`path` is appended to the bound URL, for a consumer that wants a sub-path as its
+base (e.g. `{ ref: vllm, bind: VLLM_API_BASE, path: /v1 }`).
+
 A **program**'s host-package preconditions stay on the program as
 `system_dependencies` (a plain list of package names); the model synthesizes the
 `{kind: system}` requirements from it for the `functional?` check. This split keeps