Guardian LAN/mDNS self-advertisement

[itlackey]

Spun out of #436 (Part 2) and #432 (Phase 6). Network partitioning landed in 0.12.0; the mDNS self-advertisement piece is deferred to 0.13.0.

Scope

When LAN access is explicitly enabled (via OP_BIND_ADDRESS, #395), the guardian and (optionally) the assistant advertise themselves on the local network over mDNS:

• Guardian advertises as <assistant-name>-guardian.local.
• When assistant LAN access is enabled, assistant advertises as <assistant-name>.local.

Notes / current state (0.12.0)

• mDNS is currently scaffolded but default-off; the sidecar uses apk add at container boot rather than a baked image — replace with a baked image / a tiny Bun responder (the guardian is a Bun process, not an OpenCode process, so OpenCode --mdns does not apply).
• Must stay off by default; only advertises when LAN exposure is explicitly opted in. Never public without explicit opt-in.

Acceptance

• mDNS responder baked (no boot-time apk add).
• Advertises only when LAN access is enabled; loopback-only default emits nothing.
• Admin UI surfaces the .local name when enabled.

[itlackey]

Coordination note from UI Runtime Modes plan

mDNS self-advertisement (#488) is the discovery mechanism for the assistant-container mode (#510) — when a user opens the PWA (#511) and adds a new connection, mDNS is how they find the assistant URL on their LAN without typing an IP address.

The ConnectionEntry model (in the connections refactor, Phase 2) will need to support mDNS-discovered entries alongside manually-entered URLs. Suggest tracking this as an enhancement to #486/#510 once the base connection flow lands.

[itlackey]

Verification pass on synced main after PR #559 merge (c1eadbd30e107f76b71aa933b71edcaedaadba46).

Current state:

• Docs say the old avahi sidecars were removed and assistant mDNS relies on OpenCode native mDNS when explicitly enabled.
• The same docs also state native OpenCode mDNS cannot advertise the Guardian front door as <name>-guardian.local.
• I did not find a Guardian-specific responder that advertises the Guardian HTTP/TLS endpoint.

Remaining work to complete this issue:

• Decide the supported discovery target: assistant only, guardian only, or both. The issue acceptance text asks for Guardian and optional assistant advertisement.
• For Guardian discovery, add a small baked responder or host-side mechanism that advertises the actual Guardian URL/name, not the loopback-bound moderation OpenCode process.
• Keep mDNS off by default and only enable when LAN exposure is explicitly opted in.
• Coordinate with Guardian edge TLS + CORS for remote clients (Phase 6.5 — gates the phone/PWA story) #557 so discovery advertises HTTPS names when TLS is enabled, not stale plain-HTTP names.
• Surface discovered or configured .local names in the admin/client connection UI.

Suggested verification gate:

• Loopback/default install emits no mDNS records.
• LAN-enabled install advertises the expected name(s) without boot-time package installation.
• A client on the LAN can discover the advertised name and add it as a connection.
• If TLS is enabled, the advertised endpoint is the HTTPS Guardian endpoint.