feat(docker-new): enable lo multicast and DDS sysctl tuning at startup

[xmfcx]

• Enable multicast on the loopback interface so Cyclone/FastDDS discovery works when traffic is pinned to lo.
• Apply the DDS system-wide network tuning (net.core.rmem_max, net.ipv4.ipfrag_time, net.ipv4.ipfrag_high_thresh) at container startup.
• All calls are guarded with || true so containers without NET_ADMIN / --privileged still start cleanly.

Why

The DDS tuning docs ask every user to apply these sysctls manually on the host, and loopback multicast is off by default on most distros. Doing it inside the entrypoint means the docker-new image works out of the box for single-host DDS without extra setup steps, while gracefully degrading when capabilities are missing.

---

Test plan

• Pull a prebuilt image (or build locally via docker buildx bake -f docker-new/docker-bake.hcl base):

  docker pull ghcr.io/autowarefoundation/autoware-new:base-jazzy
  

• Run privileged and confirm settings were applied:

  docker run --rm --privileged ghcr.io/autowarefoundation/autoware-new:base-jazzy bash -c "ip -d link show lo | grep -i multicast && sysctl net.core.rmem_max net.ipv4.ipfrag_time net.ipv4.ipfrag_high_thresh"
  

  Expect MULTICAST flag on lo and values 2147483647, 3, 134217728.
• Run unprivileged and confirm container still starts (sysctls silently skipped):

  docker run --rm ghcr.io/autowarefoundation/autoware-new:base-jazzy bash -c "echo entrypoint ok"
  

  Expect entrypoint ok with no fatal errors from the sysctl / ip link calls.
• Smoke test ROS 2 multicast discovery on loopback inside the container (two terms, ros2 topic pub / ros2 topic echo with ROS_LOCALHOST_ONLY=1).

[github-actions]

Thank you for contributing to the Autoware project!

🚧 If your pull request is in progress, switch it to draft mode.

Please ensure:

• You've checked our contribution guidelines.
• Your PR follows our pull request guidelines.
• All required CI checks pass before marking the PR ready for review.