fix: address review findings (network ns, journal path, CI semantics)

- network_mode: host so prometheus.exporter.unix reports real host
  interfaces (eth0...) rather than the alloy container's veth pair.
- loki.source.journal: set path = "/var/log/journal" explicitly so it
  doesn't silently fall through to /run/log/journal on volatile-journal
  hosts.
- cadvisor keep-list: add container_memory_working_set_bytes (drives
  several panels on the standard Docker dashboard).
- Drop /dev/kmsg device + extra_hosts:host.docker.internal — neither is
  needed by the current keep-lists, and host-network mode makes the
  extra_hosts entry meaningless.
- CI: extend Alloy validation beyond `fmt` (syntax-only) by booting
  alloy with the embedded config and asserting it stays running, which
  catches bad component refs / wrong arg names that fmt accepts.
- README: refresh Mounts table + Security note to match.

alloy/docker-compose.yml

@@ -9,6 +9,7 @@ services:
     restart: unless-stopped
     hostname: ${ALLOY_HOSTNAME:?required}
     privileged: true
+    network_mode: host                        # node_exporter netdev/netstat sees real host interfaces (eth0…) not veth
     environment:
       ALLOY_DEPLOY_MODE: docker
       REMOTECFG_URL: ${REMOTECFG_URL:?required}
@@ -29,10 +30,6 @@ services:
       - /var/lib/docker/:/var/lib/docker:ro
       - /var/log/journal:/var/log/journal:ro
       - /etc/machine-id:/etc/machine-id:ro    # stable host id for systemd journal reader
-    extra_hosts:
-      - 'host.docker.internal:host-gateway'
-    devices:
-      - /dev/kmsg
     configs:
       - { source: alloy_config, target: /etc/alloy/config.alloy }
     command: 'run --storage.path=/var/lib/alloy/data /etc/alloy/config.alloy'
@@ -151,6 +148,7 @@ configs:
 
         loki.source.journal "default"  {
             max_age       = "12h0m0s"
+            path          = "/var/log/journal"
             forward_to    = [loki.process.default.receiver]
             relabel_rules = loki.relabel.default.rules
         }
@@ -201,7 +199,7 @@ configs:
 
           rule {
               source_labels = ["__name__"]
-              regex         = "container_cpu_usage_seconds_total|container_fs_reads_total|container_fs_usage_bytes|container_fs_writes_total|container_last_seen|container_memory_usage_bytes|container_network_receive_bytes_total|container_network_receive_errors_total|container_network_receive_packets_dropped_total|container_network_transmit_bytes_total|container_network_transmit_errors_total|container_network_transmit_packets_dropped_total|container_spec_memory_reservation_limit_bytes|machine_memory_bytes|machine_scrape_error|up"
+              regex         = "container_cpu_usage_seconds_total|container_fs_reads_total|container_fs_usage_bytes|container_fs_writes_total|container_last_seen|container_memory_usage_bytes|container_memory_working_set_bytes|container_network_receive_bytes_total|container_network_receive_errors_total|container_network_receive_packets_dropped_total|container_network_transmit_bytes_total|container_network_transmit_errors_total|container_network_transmit_packets_dropped_total|container_spec_memory_reservation_limit_bytes|machine_memory_bytes|machine_scrape_error|up"
               action        = "keep"
           }
       }