v0.96.0 — R-50 island NIC: provision attaches the guest island net1

- LocalAPIConfig.island_bridge + island_guest_addr (+ IslandEnabled, Validate
  all-or-nothing + CIDR guard)
- buildBringUpConfig attaches static net1 (island) on provision + DR when set;
  absent otherwise (pre-R-50 byte-for-byte). Plumbed from cfg.LocalAPI at both
  RunBringUp sites. Endpoint already follows listen_addr (A0: no template change).
- healer stays eth0-only (A3 verify-only) — red-proof test locks the scoping
- example config + firewall example rewritten for the island; REUSE updated
- 3 non-hollow tests; full green. MinAgent unchanged.

Coupling: host-install island config requires agent >= 0.96.0 (vouch first).

configs/agent.example.json

@@ -48,10 +48,16 @@
   },
   "local_api": {
     "enable": true,
-    "listen_addr": "192.168.0.162:8443",
+    "listen_addr": "169.254.253.1:8443",
     "cert_file": "/var/lib/felhom-agent/local-api.crt",
     "key_file": "/var/lib/felhom-agent/local-api.key",
-    "token_store": "/var/lib/felhom-agent/local-tokens.log"
+    "token_store": "/var/lib/felhom-agent/local-tokens.log",
+    "island_bridge": "vmbr9",
+    "island_guest_addr": "169.254.253.2/30"
+  },
+  "lan_resolver": {
+    "enable": true,
+    "host_ip": "192.168.0.162"
   },
   "log_level": "info"
 }