fix: simplify dashboard and disable unauthorized actions

internal/dockerdaemon/dockerdaemon.go

@@ -132,6 +132,15 @@ func (a *Adapter) Confirmation(bool) string {
 
 // DiagnosticChecks performs only systemctl show and filesystem reads/metadata
 // probes; service reload/restart and all configuration mutations are excluded.
+func (a *Adapter) MutationAuthority(context.Context) target.Check {
+	if a.authority.EffectiveUID() != 0 {
+		return target.Check{Name: "mutation authority", Evidence: "Docker daemon changes require root authority; restart with sudo proxyctl"}
+	}
+	check := target.ReadOnlyWriteAuthority(a.configuration.DaemonConfigPath, a.configuration.RecoveryPath)
+	check.Name = "mutation authority"
+	return check
+}
+
 func (a *Adapter) DiagnosticChecks(ctx context.Context, _ *profile.Profile) []target.Check {
 	commandCheck := target.Check{Name: "required command and service", OK: true, Evidence: "systemctl can inspect the loaded docker.service"}
 	if availability, err := a.detect(ctx); err != nil || !availability.Available {