Add runner-token CLI and fix container DNS for runner registration

Two deployment gaps surfaced by the runner authorization change (b4bb966):

1. Runners now require a registration token, but tokens could only be
   minted via authenticated web routes. Add `cave-server runner-token`
   (instance/org/repo/user scope, --quiet for scripting) so deploys can
   mint tokens headlessly. Tokens are single-use and the runner
   re-registers on every start, so add `--token-file` to the runner
   subcommand: an ExecStartPre mints a fresh token per start and the
   runner reads it from the file. runner-token routes all log/config
   noise to stderr (llog's appender is a synonym-stream to
   *standard-output*) so --quiet stdout pipes cleanly into the file.

2. A host named "cave" (cloud-init writes 127.0.0.1 cave into the host
   /etc/hosts) leaks into every container via podman's default
   base_hosts_file, shadowing aardvark's DNS record for the cave
   container and breaking the runner's grpc://cave:9443 lookup. cavectl
   now passes --no-hosts to every managed container so names resolve via
   DNS, and the generated runner quadlet wires the per-start token mint.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>