Docker CLI in the image (static client for a mounted host socket)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/MOVING.md

@@ -104,8 +104,7 @@ any host folder.
 - Admins' agents and terminals (they run without sandbox) can use it.
 - Sandboxed users do not see the socket (the sandbox does not mount `/var/run`).
 - `docker` and `docker-compose` commands always need an approval, except in *bypass* mode.
-- The image has no Docker CLI; agents install the static CLI into their home when they need it
-  (on the tools disk with `--tools-dir`).
+- The image contains the Docker CLI (static client); the daemon is the host's.
 
 The current host has the same setup in its local `docker-compose.override.yml` (group 997).