feat(llm-proxy): microVM guests reach their models through the node relay, holding no key

A microVM guest still received its backend's real key (as ANTHROPIC_AUTH_TOKEN
or CLAUDE_CODE_OAUTH_TOKEN). Guest→provider traffic is TLS end to end through
the node's CONNECT proxy, so nothing on that path can swap a credential.

fcagent already pipes 127.0.0.1:11434 → vsock 9003 in EVERY guest (built for
the local-model backend), so no rootfs rebuild is needed:

- node 0.5.0: local_model::target_for sends that pipe to the node's own model
  (local backend, unchanged) or, when vm_create carries `model_relay`, to the
  server's LLM proxy — tailnet (100.64/10) ip:port only, so no message can point
  a node at the internet. The guard test is restated for the new invariant: the
  guest still never chooses where the pipe goes. Advertises `model_relay`.
- server: llm_proxy::microvm_relay relays only when the proxy is on,
  CLAWMATES_LLM_PROXY_NODE_ADDR is set, the backend has a route, and the node
  reports model_relay — an older node keeps the old path rather than a guest
  whose model calls go nowhere. The guest then gets the mission token and
  ANTHROPIC_BASE_URL=http://127.0.0.1:11434/<route>, nothing else.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

Cargo.lock

@@ -998,7 +998,7 @@ dependencies = [
 
 [[package]]
 name = "clawmates-node"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "base64 0.22.1",
  "bytes",