DEVX-155: fix: kill inner dockerd with SIGKILL, use alt socket if alive

The inner dockerd started by the CI image doesn't respond to SIGTERM.
Use pkill -9 to force-kill it, then verify it's actually dead by
running docker info. If the old daemon is still alive (can't be killed),
use /dev/shm/docker.sock as an alternate socket path to avoid conflicts.

Also moved the data root cleanup after the kill verification, so we
don't delete files while the old daemon might still be writing to them.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

tests/unit/test_start_docker.py

@@ -218,9 +218,52 @@ class TestStartDockerDaemon:
         mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
         mock_ready.side_effect = [True, False, False, False, False, True]
         mock_free.return_value = 5 * 1024**3
+        # mock_run: pkill calls (x2), docker info check (returncode=1 = dead), rm call
+        mock_run.side_effect = [
+            MagicMock(),
+            MagicMock(),
+            MagicMock(returncode=1),
+            MagicMock(),
+        ]
         assert start_docker_daemon(timeout=5) is True
         mock_popen.assert_called_once()
 
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes")
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker.subprocess.run")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    @patch("devx.molecule.start_docker.time.sleep")
+    def test_inner_dockerd_alive_uses_alt_sock(
+        self,
+        mock_sleep: MagicMock,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_run: MagicMock,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Should use /dev/shm/docker.sock if inner dockerd can't be killed."""
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        mock_ready.side_effect = [True, False, False, False, False, True]
+        mock_free.return_value = 5 * 1024**3
+        # mock_run: pkill calls (x2), docker info check (returncode=0 = alive), rm call
+        mock_run.side_effect = [
+            MagicMock(),
+            MagicMock(),
+            MagicMock(returncode=0),
+            MagicMock(),
+        ]
+        assert start_docker_daemon(timeout=5) is True
+        mock_popen.assert_called_once()
+        assert os.environ.get("DOCKER_HOST") == "unix:///dev/shm/docker.sock"
+
     @patch("devx.molecule.start_docker._diagnose_socket")
     @patch("devx.molecule.start_docker._get_docker_free_bytes")
     @patch("devx.molecule.start_docker.is_docker_ready")