fix: mount /dev/kmsg and /run/udev/data for cadvisor + diskstats

clears two startup warnings:
 - cadvisor "Could not configure a source for OOM detection" — needs
   /dev/kmsg bind-mount and CAP_SYSLOG (kernel.dmesg_restrict=1 default)
 - node-exporter "Failed to open /run/udev/data" — diskstats collector
   enriches node_disk_* with model/serial/WWN labels from udev

both mounted read-only. CAP_SYSLOG added alongside DAC_OVERRIDE.

alloy/docker-compose.yml

@@ -17,7 +17,7 @@ services:
       GRAFANA_TOKEN: ${GRAFANA_TOKEN:?required}
     security_opt: [ "no-new-privileges:true" ]
     cap_drop:     [ ALL ]
-    cap_add:      [ DAC_OVERRIDE ]                # root loses all caps; DAC_OVERRIDE is needed to write alloy-owned /var/lib/alloy/data and read root-owned journal/docker dirs
+    cap_add:      [ DAC_OVERRIDE, SYSLOG ]        # DAC_OVERRIDE: write alloy-owned /var/lib/alloy/data + read root-owned mounts. SYSLOG: read /dev/kmsg when kernel.dmesg_restrict=1.
     volumes:
       - alloy-data:/var/lib/alloy/data                              # remotecfg + storage state
       - /var/run/docker.sock:/var/run/docker.sock:ro                # discovery.docker + loki.source.docker (streams log API)
@@ -27,6 +27,8 @@ services:
       - /:/rootfs:ro,rslave                                         # filesystem collector (rslave picks up new mounts)
       - /var/log/journal:/var/log/journal:ro                        # loki.source.journal
       - /etc/machine-id:/etc/machine-id:ro                          # stable host id for journal reader
+      - /dev/kmsg:/dev/kmsg:ro                                      # cadvisor OOM event detection
+      - /run/udev/data:/run/udev/data:ro                            # node-exporter diskstats device labels (model/serial/WWN)
     configs:
       - { source: alloy_config, target: /etc/alloy/config.alloy }
     command: [ run, --server.http.listen-addr=0.0.0.0:12345, --storage.path=/var/lib/alloy/data, /etc/alloy/config.alloy ]