Harden the Envoy network-proxy backend

[ChrisJBurns]

Part of #5900. Follow-up after the Envoy backend lands.

Goal

Close the known rough edges in the initial Envoy backend before wider use.

Tasks

• Pin the image by digest. defaultEnvoyImage is currently tag-pinned (envoyproxy/envoy-distroless:v1.32.3). Pin by digest and document the TOOLHIVE_ENVOY_IMAGE override for supply-chain policy.
• Lock down the admin interface. Admin binds to 127.0.0.1 today; consider disabling it entirely (or gating behind a debug flag) since it is not needed at runtime.

Notes

Small, independent cleanups. None block the backend from being usable, but they matter before recommending it broadly.