fix(blackbox): unit had no Image and no Network=host - quadlet refused to generate it

The deploy died at 'Unit blackbox-exporter.service not found': a
.container without Image= is not generated at all, and the header
argued for Network=host it never declared. Completes the unit (digest
pinned prom/blackbox-exporter, Network=host) and fixes the bind
topology the first cut got wrong:

- Prometheus is bridge-networked and the netavark hairpin gap bars it
  from its own host's LAN IP, so a LAN-only prober bind is unscrapable
  and a loopback-only bind was claimed to ride the gateway on faith.
  The prober now binds 9115 on the podman gateway (scrape path) AND
  the LAN (healthcheck/diagnostics); the listen_address line leaves
  blackbox.yml so config and Exec cannot disagree.
- comfyui probe target http://comfyui:8188 -> http://127.0.0.1:8188:
  bridge container names do not resolve in the host netns; the
  published 0.0.0.0:8188 answers on loopback there.
- New seam: every observability unit must declare Image= (red on the
  shipped file by name); copier test pinned module presence instead
  of the removed listen line. Docs updated to the real topology.

shared/prometheus/prometheus.yml

@@ -64,11 +64,13 @@ scrape_configs:
   # web root is NOT a health check — an HTML front page fails the scrape
   # protocol (`unsupported Content-Type`), which is exactly why the old
   # `services` and `comfyui` jobs were red forever beside healthy services
-  # (Stale Signal Audit §1). The prober is a host-netns container reached at
-  # the podman gateway name (HostAddr= on the prometheus unit); it in turn
-  # reaches both the host LAN IP and bridge container names. comfyui's UI probe
-  # lives here now — its own metrics-scrape job is retired, one owner per
-  # service.
+  # (Stale Signal Audit §1). The prober is a host-netns container listening on
+  # the podman gateway (the scrape address below - the netavark hairpin gap
+  # bars this container from its own host's LAN IP, cadvisor job note) and on
+  # the LAN; from that netns it reaches the host LAN IP, and published ports
+  # via 127.0.0.1 - bridge container names do NOT resolve in the host netns,
+  # which is why comfyui's probe is a loopback URL. comfyui's own
+  # metrics-scrape job is retired, one owner per service.
   - job_name: "services"
     metrics_path: /probe
     params:
@@ -77,7 +79,7 @@ scrape_configs:
       - targets:
           - "http://192.168.0.143:8081"   # SearXNG (via the Gluetun tunnel)
           - "http://192.168.0.143:3005"   # OpenWebUI
-          - "http://comfyui:8188"         # ComfyUI UI (gfx1151 generator)
+          - "http://127.0.0.1:8188"        # ComfyUI UI (published 0.0.0.0:8188; probed from the prober's host netns)
     relabel_configs:
       - source_labels: [__address__]
         target_label: __param_target