relay: bind 169.254.1.2 (host.containers.internal), not loopback

A socket bound to 127.0.0.1 refuses container traffic that arrives via
the podman bridge: the first live webhook failed with 'dial tcp
169.254.1.2:18093: connection refused'. The relay now binds the
host-gateway endpoint — link-local to the podman bridge, off the LAN —
and the deployer's health probe follows it there.

shared/prometheus/prometheus.yml

@@ -14,8 +14,8 @@ rule_files:
 
 # The delivery half. Alertmanager runs on the same dankclaw_default network,
 # so it is addressed by container name, like grafana and loki below. Its
-# single receiver webhooks the host-side signal-relay (loopback :18093,
-# reachable from the container only as host.containers.internal).
+# single receiver webhooks the host-side signal-relay (169.254.1.2:18093,
+# the host.containers.internal endpoint).
 alerting:
   alertmanagers:
     - static_configs: