Fix: Docker memory guard handles cgroup v2 'max' limit correctly

[dajiaohuang]

Summary

Fixes #2123.

On cgroup v2 hosts with no container memory limit (docker run without -m, Kubernetes pods without limits, PaaS defaults), /sys/fs/cgroup/memory.max contains the literal string max. The previous code called int(limit_path.read_text()) which raised ValueError, silently caught by a bare except:, causing get_container_memory_percent() to fall through to psutil.virtual_memory().percent — reporting host-wide memory usage instead of container usage.

This meant the memory threshold guard (default 95%) was measuring unrelated host/neighbor container memory, potentially triggering OOM kills prematurely or allowing the container to grow without bound.

Changes

• Read raw limit text and check for the literal "max" sentinel before int() conversion, correctly falling back to host total RAM (as the existing comment and cgroup v1 > 1e18 branch intended).
• Narrowed the bare except: to specific exceptions: OSError, ValueError, ZeroDivisionError to prevent silent failures on unexpected parse errors.
• Moved import psutil to the top of the try block to avoid duplicate imports.

Validation

• When memory.max contains max, usage is now correctly divided by host total RAM (matching cgroup v1 unlimited behavior).
• When a numeric limit is set, behavior is unchanged.
• File read errors still fall back to host psutil reporting.