[ctfbruce]

Enrolled executors can opt into resource-limited worker processes on their first managed service installation with --isolation shared. The installer supplies a finite preset and systemd delegation, rejects incompatible existing configuration, and preserves the chosen profile through reinstallation and package replacement. Existing installations keep their current behavior.

dbl doctor now explains the isolation profile and reminds operators about certificate renewal within 14 days. Expired issuing trust is diagnosed separately from the executor certificate.

The managed preset requires Linux 5.14+, systemd 254+ and cgroup v2 with CPU, memory and PID controllers. It allows up to four workers within 1 GiB worker memory plus a 256 MiB control reserve, and 2.25 CPUs total. Runtime startup still validates actual delegation and available limits; it never falls back to trusted execution.

Validation: focused service, isolation and CLI/doctor tests passed on Linux. A fresh systemd installation, restart and unchanged reinstallation preserved enrollment and shared mode. Two browser-submitted HTTP measurements completed on the isolated executor, with the child cgroup's memory, CPU and task limits observed directly. All 17 candidate checks passed, including the required gate, kernel, race, installed local flow and guest-language validation.

Related to #168 and #116.