Stable turnstone node identity for the console's cluster view

Default node_id is {hostname}_{random-per-boot}, so every boot
inserted a new services row and the console probed stale ones (409
node_id mismatch -> 'not found' node pages). Pin TURNSTONE_NODE_ID
(one upserted row) and TURNSTONE_ADVERTISE_URL to loopback — the
guest's slirp IPv6 lands in the SSRF guard's never-allowed lane.
Also drop the futile /etc/hostname baking (podman regenerates it at
boco build).

Containerfile

@@ -51,6 +51,11 @@ RUN groupadd -g ${GROUP_ID} marvin || true && \
 RUN printf "marvin:100000:65536\n" > /etc/subuid && \
     printf "marvin:100000:65536\n" > /etc/subgid
 
+# NOTE: don't bake /etc/hostname or /etc/hosts here — podman regenerates
+# both when boco creates the build container, so they never reach the
+# qcow2. The entrypoint sets the hostname live; node identity comes from
+# TURNSTONE_NODE_ID.
+
 # SSH access for marvin (pubkey generated by scripts/build.sh)
 COPY configs/ssh/authorized_keys /tmp/authorized_keys
 RUN install -o ${USER_ID} -g ${GROUP_ID} -m 700 -d /home/marvin/.ssh && \