relay: bind 169.254.1.2 (host.containers.internal), not loopback

A socket bound to 127.0.0.1 refuses container traffic that arrives via
the podman bridge: the first live webhook failed with 'dial tcp
169.254.1.2:18093: connection refused'. The relay now binds the
host-gateway endpoint — link-local to the podman bridge, off the LAN —
and the deployer's health probe follows it there.

AGENTS.md

@@ -128,8 +128,8 @@ provisioned from `shared/grafana/provisioning/`, `shared/prometheus/rules/
 llm-fleet.yml` loads 5 alert rules + 1 recording rule, and firing rules are
 delivered: Prometheus → Alertmanager (`dankclaw/observability/quadlet/
 alertmanager.container`, loopback :9093) → host-side Signal relay
-(`scripts/signal-relay.py`, user unit, loopback :18093, reached from the
-container as `host.containers.internal`) → signal-cli account 318311. Five
+(`scripts/signal-relay.py`, user unit, 169.254.1.2:18093 — the
+host.containers.internal endpoint) → signal-cli account 318311. Five
 Prometheus targets read down for structural reasons (HTML-scraped "probes",
 Gitea metrics off); the remedy is a blackbox exporter. See
 `serverAppConfigs-docs/Infrastructure/Observability.md`.