feat(serve-profile): mount /llm switcher synthetic FS at startup

Adds llmctl9p to the headless gateway profile so /llm/{ctl,status}
is available to anything sharing the emu namespace. Host binary
path is read from $LLMCTL_BIN (default: bare "llmctl", resolved by
host PATH); skip silently with a NOTE if /dis/llmctl9p.dis isn't
installed yet, since the gateway can still serve with whatever
backend /lib/ndb/llm already points at.

This is the headless companion to dis/wm/settings's local-stack
selector — same control plane, different entry point: SSH users
write `echo "set sglang" > /llm/ctl` while desktop users click
Settings → Apply.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>