Wait for real guest vsock health before opencode

Make vm create wait for the guest-side vsock /healthz endpoint instead of only waiting for the host socket path, so the wait_vsock_agent stage reflects actual guest readiness.

Start banger-vsock-agent earlier in the Alpine OpenRC graph and report later /ports failures as guest-service waits rather than vsock-agent waits, which makes the progress output match what the guest is really doing.

Validate with go test ./..., a rebuilt managed alpine image, and a fresh vm create --image alpine --name alp --nat that now progresses through wait_vsock_agent -> wait_guest_ready -> wait_opencode -> ready.

scripts/make-rootfs-alpine.sh

@@ -225,7 +225,7 @@ description="Banger guest network bootstrap"
 
 depend() {
   need localmount
-  before sshd docker banger-vsock-agent banger-opencode
+  before sshd docker banger-opencode
   provide net
 }
 
@@ -265,7 +265,7 @@ command="/usr/local/bin/banger-vsock-agent"
 
 depend() {
   need localmount
-  after banger-network
+  before banger-network sshd docker banger-opencode
 }
 
 start_pre() {