Wait for real guest vsock health before opencode

Make vm create wait for the guest-side vsock /healthz endpoint instead of only waiting for the host socket path, so the wait_vsock_agent stage reflects actual guest readiness.

Start banger-vsock-agent earlier in the Alpine OpenRC graph and report later /ports failures as guest-service waits rather than vsock-agent waits, which makes the progress output match what the guest is really doing.

Validate with go test ./..., a rebuilt managed alpine image, and a fresh vm create --image alpine --name alp --nat that now progresses through wait_vsock_agent -> wait_guest_ready -> wait_opencode -> ready.

internal/opencode/opencode.go

@@ -87,7 +87,7 @@ func waitReady(ctx context.Context, logger *slog.Logger, socketPath string, time
 			lastErr = fmt.Errorf("guest port %d is not listening yet", Port)
 		} else {
 			if report != nil {
-				report("wait_vsock_agent", "waiting for guest vsock agent")
+				report("wait_guest_ready", "waiting for guest services")
 			}
 			lastErr = err
 		}

internal/opencode/opencode_test.go

@@ -57,6 +57,7 @@ func TestWaitReadyReturnsWhenPortIsListening(t *testing.T) {
 	socketPath := filepath.Join(t.TempDir(), "opencode.vsock")
 	listener, err := net.Listen("unix", socketPath)
 	if err != nil {
+		skipIfSocketRestricted(t, err)
 		t.Fatalf("listen: %v", err)
 	}
 	t.Cleanup(func() {
@@ -114,3 +115,37 @@ func TestWaitReadyReturnsWhenPortIsListening(t *testing.T) {
 		t.Fatalf("server: %v", err)
 	}
 }
+
+func TestWaitReadyReportsGuestServicesWhenPortsUnavailable(t *testing.T) {
+	t.Parallel()
+
+	var reports []string
+	err := waitReady(
+		context.Background(),
+		nil,
+		filepath.Join(t.TempDir(), "missing.vsock"),
+		50*time.Millisecond,
+		func(stage, detail string) {
+			reports = append(reports, stage+":"+detail)
+		},
+	)
+	if err == nil {
+		t.Fatal("waitReady() error = nil, want timeout")
+	}
+	if len(reports) == 0 {
+		t.Fatal("waitReady() did not report progress")
+	}
+	if got := reports[0]; got != "wait_guest_ready:waiting for guest services" {
+		t.Fatalf("first report = %q, want guest services wait", got)
+	}
+}
+
+func skipIfSocketRestricted(t *testing.T, err error) {
+	t.Helper()
+	if err == nil {
+		return
+	}
+	if strings.Contains(strings.ToLower(err.Error()), "operation not permitted") {
+		t.Skipf("socket creation is restricted in this environment: %v", err)
+	}
+}