fix(blackbox): unit had no Image and no Network=host - quadlet refused to generate it

The deploy died at 'Unit blackbox-exporter.service not found': a
.container without Image= is not generated at all, and the header
argued for Network=host it never declared. Completes the unit (digest
pinned prom/blackbox-exporter, Network=host) and fixes the bind
topology the first cut got wrong:

- Prometheus is bridge-networked and the netavark hairpin gap bars it
  from its own host's LAN IP, so a LAN-only prober bind is unscrapable
  and a loopback-only bind was claimed to ride the gateway on faith.
  The prober now binds 9115 on the podman gateway (scrape path) AND
  the LAN (healthcheck/diagnostics); the listen_address line leaves
  blackbox.yml so config and Exec cannot disagree.
- comfyui probe target http://comfyui:8188 -> http://127.0.0.1:8188:
  bridge container names do not resolve in the host netns; the
  published 0.0.0.0:8188 answers on loopback there.
- New seam: every observability unit must declare Image= (red on the
  shipped file by name); copier test pinned module presence instead
  of the removed listen line. Docs updated to the real topology.

dankclaw/observability/quadlet/prometheus.container

@@ -45,10 +45,11 @@ Wants=network-online.target
 ContainerName=prometheus
 Image=docker.io/prom/prometheus:latest
 Network=dankclaw_default
-# Name the podman gateway so scrape jobs can reach host-netns processes (the
-# blackbox exporter listens on the host's loopback; a bridge container reaches
-# it at this address, never at 127.0.0.1). Same mechanism the hermes Caddy
-# upstream learned the hard way (Container Host Reachability in the vault).
+# Name the podman gateway so scrape jobs can reach same-host targets (the
+# netavark hairpin gap bars this container from dialing its own host's LAN
+# IP; the cadvisor/gpu jobs and the blackbox scrape all ride this name).
+# Same mechanism the hermes Caddy upstream learned the hard way (Container
+# Host Reachability in the vault).
 HostAddr=host.containers.internal=169.254.1.2
 User=0:0
 Exec=--config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/prometheus --storage.tsdb.retention.time=30d --web.enable-lifecycle