Policy admission for service-owned container image pulls

## Problem

`POST /vms/create` with a `container` workload makes capsem-service pull the OCI image from its registry **on the host** (`crates/capsem-service/src/container_setup.rs`, `ImageSource::pull`). That egress never crosses the VM's network path, so:

- a profile whose rules block a registry host cannot stop the pull;
- no rule can refuse an image by reference or digest;
- the session ledger records the staged files (file import rows) but not the registry fetch itself.

This predates #207: the CLI in #200 also pulled on the host. #207 moved the pull into the service and made exposures policy-admitted (`network.lifecycle` with an exposure context), which makes the gap for images more visible.

## Options

1. **Owner-side admission before the pull.** The service asks the VM owner to evaluate a lifecycle-style event carrying the image reference, registry host and (after resolution) digest against the VM's effective rules, with the audit row admitted first; deny/ask refuses the setup before any network request. Needs a new owner IPC request and CEL facts (e.g. `container.image`, `container.registry`, `container.digest`) — or a `network`-root fact set if kept within the network family.
2. **Treat the pull as the VM's HTTP egress.** Evaluate an `http.request`-shaped event per registry request (host, path) so existing HTTP host rules apply unchanged. Reuses rules users already write, but per-request evaluation on a host-side client is new and noisy.
3. **Pull through the VM's egress path.** Route the service's registry client through the per-VM MITM proxy so policy and telemetry apply as for guest traffic. Strongest parity, largest change.

## Acceptance

- A rule can refuse a registry host and a specific image before any registry byte is sent (black-box: fixture registry records zero requests).
- The decision and the image identity are recorded in the session ledger; an unadmittable audit refuses the setup.
- Registry credentials never appear in the ledger or logs (flush-barrier proof).

Found while closing #207.

Start in crates/capsem-service/src/container_setup.rs at ImageSource::pull, then read the policy-admission changes from #207 and the host-side pull context in #200. Compare the three proposed approaches and identify the owner IPC and CEL facts required by the chosen design. Done means the fixture registry receives zero requests on denial, the decision and image identity reach the session ledger, and credentials are absent from logs and the ledger.

Written by the indexing model from the issue text.