Wait for real guest vsock health before opencode

Make vm create wait for the guest-side vsock /healthz endpoint instead of only waiting for the host socket path, so the wait_vsock_agent stage reflects actual guest readiness.

Start banger-vsock-agent earlier in the Alpine OpenRC graph and report later /ports failures as guest-service waits rather than vsock-agent waits, which makes the progress output match what the guest is really doing.

Validate with go test ./..., a rebuilt managed alpine image, and a fresh vm create --image alpine --name alp --nat that now progresses through wait_vsock_agent -> wait_guest_ready -> wait_opencode -> ready.

internal/opencode/opencode.go

@@ -87,7 +87,7 @@ func waitReady(ctx context.Context, logger *slog.Logger, socketPath string, time
 			lastErr = fmt.Errorf("guest port %d is not listening yet", Port)
 		} else {
 			if report != nil {
-				report("wait_vsock_agent", "waiting for guest vsock agent")
+				report("wait_guest_ready", "waiting for guest services")
 			}
 			lastErr = err
 		}