fix(compose): add LAN-only MCP binding

[jmagar]

Summary

• retain the configurable primary and loopback MCP binding
• add an explicit 10.1.0.6 LAN binding for the trusted reverse-proxy path
• document the production binding change in CHANGELOG.md

Validation

• 10.1.0.6 is assigned on DOOKIE
• docker compose config --no-interpolate --quiet
• git diff --check

CI hardening

• pin the shared Rust cache action to upstream Kache 0.13.0
• align hosted and self-hosted runners on the stabilized daemon protocol and cache epoch
• verified the pinned upstream release and Linux x86_64 asset/checksum