Bind tentacle healthz to loopback on Windows to stop firewall prompt

Summary

Operator report: a Windows Defender Firewall "allow this app to communicate" prompt appears on every upgrade of a SYSTEM-service Polling Tentacle.

Root cause: the health-check server binds http://*:{port}/ (all interfaces) — HealthCheckServer.cs. Windows prompts when an app opens a listening socket on a public interface, and the blue-green versioned layout gives each upgrade a new binary path, which the path-keyed firewall treats as a new app → fresh prompt every upgrade. For an unattended SYSTEM service, the prompt may even leave the new binary's listener blocked.

Fix: default the bind host to loopback on Windows (127.0.0.1) — firewall-exempt, and the only Windows consumer of healthz is the upgrade script, which probes 127.0.0.1. Keep * on non-Windows so Linux/docker localhost health checks and the Kubernetes agent's kubelet httpGet liveness/readiness probes (over the pod network) still work — the agent's Helm chart sets Tentacle__HealthCheckBindHost: "+" explicitly. Configurable via Tentacle__HealthCheckBindHost.

Takes effect on the upgrade to 1.8.16 (the new binary binds loopback → no prompt).

Test plan

• HealthCheckServer + TentacleApp tests green; new pins: OS-conditional default (Win→127.0.0.1, else *) + explicit-loopback reachable via 127.0.0.1
• helm template renders Tentacle__HealthCheckBindHost: "+" for the K8s agent
• Windows E2E (dispatched on this branch)
• Manual: upgrade a Windows polling tentacle to 1.8.16 → no firewall prompt; healthz still passes