cgroup: if container is stopped return -1

STOPPED is actually 0, which means success, and leads the caller to
trick himself into a segv.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
use the right fn to get cgpath to enter at attach, and add some better fn comments.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>