fix(vm): preserve guest TLS hostname

[drew]

Summary

Fix VM sandbox provisioning for package-managed local mTLS gateways by adding the missing /image-cache mountpoint and keeping guest callbacks on the certificate-valid host.openshell.internal alias.

Related Issue

None

Changes

• Create /image-cache when preparing sandbox VM rootfs images.
• Use host.openshell.internal as the VM host-loopback alias for loopback gateway endpoints.
• Keep HTTPS gateway callbacks on host aliases instead of falling back to a bare gvproxy IP when endpoint preflight fails.

Testing

• mise run pre-commit (failed only on existing ignored markdown plan docs: architecture/plans/issue-981-sandboxprofile-feedback.md, architecture/plans/issue-994-gateway-ingress-response.md; Rust tests in the run passed)
• env RUSTC_WRAPPER= cargo test -p openshell-driver-vm
• git diff --check
• Local Homebrew VM smoke test: /opt/homebrew/bin/openshell sandbox create --no-keep --no-tty -- true

Checklist

• Follows Conventional Commits
• Commit includes Signed-off-by
• Unit tests pass
• E2E tests updated