Starting docker through Salt has always been problematic.  Kubelet or
the babysitter process should start it.  We've kept it around primarily
so we have a `service: docker` node for the Salt DAG.

Instead, we enable (but do not start) the Docker service in Salt.  This
lets us keep the DAG node, but won't start it.

There's another bug in Salt, where watches will start the service even
on `service.enabled`.  So we remove the watches, and move them to our
existing Salt bug-fix script.