Scope the agent's network exposure: hostNetwork + hostPort 8081 on every node

Why

The agent binds its full API to each node's IP rather than to a cluster-internal
Service. hostNetwork: true and hostPort: 8081 are both defaults
(deploy/helm/nvsnap/values.yaml:182, templates/agent-daemonset.yaml:227).

That is wider than what the design needs. Two different things are served on the
same port:

• Peer fan-out (/v1/checkpoints/{id}/manifest, /file, /v1/captures/{hash}/*),
  which genuinely requires agent-to-agent reachability across nodes.
• Node-local control (POST /v1/checkpoint, POST /v1/restore,
  DELETE /v1/checkpoints/{id}, /v1/restore/prep, /debug/pprof/*), which does
  not.

Only the first group justifies node-IP exposure. The second is reachable from
anywhere on the node network as a side effect of sharing the listener.

NetworkPolicy is not a workaround here: a hostNetwork pod carries node identity,
so a podSelector ingress rule will not match it under most CNIs. The comment at
values.yaml:454 already records this.

Companion to #486 (authentication). Authenticating the API is the higher-value
fix and should land first; this issue is about not exposing more surface than the
peer protocol needs, so a single credential leak has a smaller blast radius.

What to do

Options, roughly in order of preference:

1. Split the listeners. Keep peer fan-out on the hostPort and move node-local
   control to a separate listener bound to localhost or to a cluster Service.
   Callers on the node (restore-entrypoint, init containers) reach it over
   loopback; the webhook and server reach it over the Service.
2. Keep one listener but bind hostPort only where the peer protocol is enabled,
   so deployments that do not use cascade fan-out never expose it.
3. Confirm whether hostNetwork is still required at all. The stated reason is
   host process visibility for CRIU, but that comes from hostPID and the
   bind-mounts; hostNetwork may only be carrying the hostPort. Worth verifying
   rather than assuming, since dropping it would make ordinary NetworkPolicy
   apply again.

Whichever option, /debug/pprof/* should not be on a node-reachable listener.

Notes

• Blocker for full production launch. Not externally reachable in current
  deployments.
• Changing the listener layout touches peer discovery (selfAgentURL,
  catalog-registered peer URLs), so it needs an e2e cascade fan-out run, not just
  a single-node restore.