fix(llmctl9p): disable host-crossing until spawned-helper EOF issue is fixed

The synthetic FS (Styx serving + nametree) is correct — a static
status reply round-trips fine through a mount {llmctl9p ...} /llm
client. What hangs is the host crossing: a spawned helper that does
FORKFD + dup(pipe_wr, 1/2) and then loads /dis/os.dis via the
Command interface never causes the parent's drain loop to see EOF,
so the Twrite/Tread reply stays held forever.

Diagnostic narrowed it past three hypotheses:
  - not a styxservers/nametree bug (static reply works)
  - not Sh->system specifically (Command-loaded os.dis hangs the same)
  - not pipe creation (sys->pipe returns valid fds)

Cause is most likely the spawned proc's fd lifetime: the dup'd
write-ends in the helper never reduce to zero refs even after the
helper returns, so EOF never fires. Worth a deeper look at when an
upstream pattern lands in the tree (no canonical "spawn child, exec
host cmd, capture stdout" template found in the current codebase).

For now, both /llm/{ctl,status} return clear marker strings telling
the caller to use the host bash `llmctl` directly. Settings.b's panel
still mounts /llm successfully (the directory entries exist); the
status display will show the marker string instead of live state
until the host crossing lands. The headless production path
(systemd user units + host llmctl) is unaffected by this issue.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>