Judge the runtime's daemon.json against the docker module's own keys, not a frozen copy

The test pinned daemon.json to live-restore alone, so every controller check failed once the
docker module gained log rotation as a preference (mesh-catalog #205, #217). It still refuses
dns (ADR 0196) and any key the module does not declare, and checks the log defaults where the
module declares them (novox/hq issue 498).

internal/catalogue/resolver_manifests_test.go

@@ -194,8 +194,31 @@ func TestTheResolverAndWhatAsksItComposeOnOneMachine(t *testing.T) {
 	if err := json.Unmarshal([]byte(runtime["content"].(string)), &keys); err != nil {
 		t.Fatalf("the runtime's keys are not JSON: %v", err)
 	}
-	if len(keys) != 1 || keys["live-restore"] != true {
-		t.Errorf("the runtime is given %v; live-restore and nothing else", keys)
+	// What the runtime is given is what its own module declares, and nothing a layer or another module
+	// adds. This used to say "live-restore and nothing else", to hold the line ADR 0196 drew when `dns`
+	// left the file; since the docker module gained log rotation as a preference (mesh-catalog #205 and
+	// #217, novox/hq issue 452) that frozen copy failed every check (novox/hq issue 498). So the keys are
+	// judged against the module's own daemon.json instead: live-restore is given, `dns` never is, and no
+	// key the module does not declare appears.
+	if keys["live-restore"] != true {
+		t.Errorf("the runtime is given %v; a restart must keep every container running (live-restore)", keys)
+	}
+	if _, ok := keys["dns"]; ok {
+		t.Errorf("the runtime is given a resolver of its own, %v; a container copies its machine's (ADR 0196)", keys["dns"])
+	}
+	declared := daemonKeysDeclared(t)
+	for key := range keys {
+		if !declared[key] {
+			t.Errorf("the runtime is given %q, which the docker module does not declare: %v", key, keys)
+		}
+	}
+	// The log rotation preference, at its defaults, wherever the module declares it. The copy captured in
+	// testdata/beside predates it, so outside a merge check it is not there to judge.
+	if declared["log-driver"] {
+		opts, _ := keys["log-opts"].(map[string]any)
+		if keys["log-driver"] != "json-file" || opts["max-size"] != "100m" || opts["max-file"] != "10" {
+			t.Errorf("the runtime is given %v; its containers' logs are cut at 100m and ten are kept (novox/hq issue 452)", keys)
+		}
 	}
 	// The runtime is reloaded when that file changes, and never restarted: a restart stops every
 	// container on the machine (ADR 0102), and a reload is what turns live-restore on.
@@ -275,3 +298,26 @@ func TestTheResolverOnAMachineOffTheNetworkIsRefused(t *testing.T) {
 		t.Fatalf("a machine off the network was refused for another reason: %v", err)
 	}
 }
+
+// daemonKeysDeclared is the top-level keys of the docker module's own daemon.json, read from its
+// manifest: what the runtime may be given (novox/hq issue 498). A placeholder sits inside a JSON
+// string there, so the content parses as it is.
+func daemonKeysDeclared(t *testing.T) map[string]bool {
+	t.Helper()
+	for _, r := range catalogueManifest(t, "docker").Resources {
+		if r["id"] != "daemon" {
+			continue
+		}
+		var keys map[string]any
+		if err := json.Unmarshal([]byte(r["content"].(string)), &keys); err != nil {
+			t.Fatalf("the docker module's daemon.json is not JSON: %v", err)
+		}
+		declared := map[string]bool{}
+		for key := range keys {
+			declared[key] = true
+		}
+		return declared
+	}
+	t.Fatal("the docker module declares no daemon.json")
+	return nil
+}