switch to trusty + go agent stemcell
upgrade to docker 0.10.0

seems to not properly protect privileged containers
remove erroneous cgroups mount short-circuit

looks like /sys/fs/cgroup is mounted on start but the actual cgroups aren't

each mount has a mountpoint -q check, so don't bother
install ca-certificates in worker ctl script for now

this is required for docker pulling stuff