Limrun network capture: serve tunnel traffic through network dump and a downloadable HAR artifact #4064

Purpose

Limrun's --provider-network-logs capture keeps completed requests in memory. Since #4080, artifacts and close write them to <state-dir>/network-har/<lease-id>.har on the daemon host. The CloudArtifact.url is that absolute daemon-host path. Remote and proxy clients can't download it, and network dump on a capture-enabled Limrun session never sees tunnel traffic.

Required behavior

• While a capture is live, Limrun's networkDump operation returns the capture's in-memory entries, mapped from DestinationTunnelHAREntry to the NetworkDumpResult shape. network dump --include headers|body then applies the daemon's payload caps and redactNetworkLogText.
• The HAR that artifacts and close write is registered with trackDownloadableArtifact, so remote and proxy clients can download it and the tracker's expiry owns retention.

Completion conditions

• agent-device network dump --include headers on a Limrun session with --provider-network-logs lists tunnel requests, with redaction applied.
• agent-device artifacts on a remote or proxy client lists a downloadable HAR, and the download yields a valid HAR 1.2 document.
• metadata.failures (count, last typed kind, last dial failure) is still reported.

Dependencies

Blocked by: #4080.