fix(install): add Docker group access security note in install flow and docs

docs/get-started/prerequisites.mdx

@@ -34,6 +34,13 @@ On Linux, the installer can install Docker, start the Docker service, and add yo
 If the group change is not active in the current shell, the installer exits with `newgrp docker` guidance before it starts onboarding.
 If you choose the native Linux Ollama install path, the onboard wizard also requires `zstd` for Ollama archive extraction.
 
+<Warning title="Docker group access">
+NemoClaw needs Docker access.
+On personal Linux development machines, adding your user to the `docker` group is the standard way to run Docker without sudo.
+Members of the `docker` group can control the daemon with root-level impact, so grant this access only to trusted local accounts; on shared or managed systems, use your organization's approved Docker access path.
+For background, review Docker's [daemon attack surface guidance](https://docs.docker.com/engine/security/#docker-daemon-attack-surface).
+</Warning>
+
 On Debian and Ubuntu, NemoClaw installs `zstd` with `apt-get` if it is missing; on other Linux distributions, install `zstd` before onboarding.
 
 On macOS, NemoClaw uses the Docker-driver OpenShell gateway path with Docker Desktop or Colima.

docs/reference/troubleshooting.mdx

@@ -80,6 +80,13 @@ On Linux, if the Docker daemon is running but you see "permission denied" errors
 The installer can add your user to the group, but Linux does not activate that membership in the current shell automatically.
 Add your user and activate the group in the current shell:
 
+<Warning title="Docker group access">
+NemoClaw needs Docker access.
+On personal Linux development machines, adding your user to the `docker` group is the standard way to run Docker without sudo.
+Members of the `docker` group can control the daemon with root-level impact, so grant this access only to trusted local accounts; on shared or managed systems, use your organization's approved Docker access path.
+For background, review Docker's [daemon attack surface guidance](https://docs.docker.com/engine/security/#docker-daemon-attack-surface).
+</Warning>
+
 ```console
 $ sudo usermod -aG docker $USER
 $ newgrp docker

scripts/install.sh

@@ -2132,7 +2132,10 @@ ensure_docker() {
   # need to run usermod.
   if ! id -nG "$current_user" 2>/dev/null | tr ' ' '\n' | grep -qx docker; then
     info "Your user '$current_user' is not in the docker group."
-    info "The next step uses sudo to add you to the group so docker works without sudo. You may be prompted for your password."
+    info "NemoClaw needs Docker access. On personal Linux development machines, adding your user to the docker group is the standard way to run Docker without sudo."
+    info "Docker group members can control the daemon with root-level impact, so grant this access only to trusted local accounts; on shared or managed systems, use your organization's approved Docker access path."
+    info "Background: https://docs.docker.com/engine/security/#docker-daemon-attack-surface"
+    info "You may be prompted for your password."
     sudo usermod -aG docker "$current_user"
     needs_group_refresh=1
   fi

src/lib/onboard/preflight.ts

@@ -625,7 +625,11 @@ export function planHostRemediation(assessment: HostAssessment): RemediationActi
         kind: "sudo",
         reason:
           "Docker is installed and the service is running, but the current user cannot reach the daemon. " +
-          "This usually means your user is not in the docker group.",
+          "This usually means your user is not in the docker group. " +
+          "NemoClaw needs Docker access. " +
+          "On personal Linux development machines, adding your user to the docker group is the standard way to run Docker without sudo. " +
+          "Docker group members can control the daemon with root-level impact, so grant this access only to trusted local accounts; on shared or managed systems, use your organization's approved Docker access path. " +
+          "Background: https://docs.docker.com/engine/security/#docker-daemon-attack-surface.",
         commands: [
           "sudo usermod -aG docker $USER",
           "newgrp docker   # or log out and back in",