Salt: Don't use Salt to start Docker

Starting docker through Salt has always been problematic.  Kubelet or
the babysitter process should start it.  We've kept it around primarily
so we have a `service: docker` node for the Salt DAG.

Instead, we enable (but do not start) the Docker service in Salt.  This
lets us keep the DAG node, but won't start it.

There's another bug in Salt, where watches will start the service even
on `service.enabled`.  So we remove the watches, and move them to our
existing Salt bug-fix script.

cluster/saltbase/salt/salt-helpers/services

@@ -63,6 +63,9 @@ elif [[ "${ACTION}" == "down" ]]; then
   reload_state
   disable_service
   stop_service
+elif [[ "${ACTION}" == "enable" ]]; then
+  reload_state
+  enable_service
 else
   echo "Unknown action: ${ACTION}"
   exit 1