fix(esphome): bind the remote-build peer-link to loopback; finish the rsync fix

ha-dev asked for the Device Builder 1.0.0 remote-build receiver to be turned
off: one instance, builds run locally, so the feature has no role, and it was
binding 0.0.0.0:6055 with mDNS advertisement on a privileged host-network
container that writes firmware to devices.

Reading the source first changed the framing. controllers/remote_build/
_state.py declares 'remote_builds_enabled: bool = True', so nobody enabled it
— it arrived on by default with the rewrite. And the flag has no on-disk
representation until it is changed: neither .device-builder.json nor
.device-builder-preferences.json carries it, and the only writer is the app's
own command API behind the UI. Setting it from a playbook would mean inventing
a schema for a model I have not read.

So this binds ESPHOME_REMOTE_BUILD_HOST=127.0.0.1 — a documented env var, no
entrypoint override — which removes the LAN reachability now and is verifiable
(ss reports 127.0.0.1:6055, was 0.0.0.0:6055). It is explicitly NOT the off
switch ha-dev asked for and the compose comment says so; the Settings toggle
is one UI click and the line can go once someone flips it.

Also completes yesterday's deploy-stack.sh fix, which was half a fix. --no-o
--no-g stopped rsync chgrp-ing a root:docker destination as a non-root
identity, but the very next deploy failed the same way one layer along —
'failed to set times on ...' — because a non-root identity cannot utime() a
root-owned directory either. Same exit 23 after a successful transfer. Added
--omit-dir-times. Fixing only the group half looked fixed until the next run,
which is the whole reason this is worth a line in the script's comment.

stacks/esphome/compose.yaml

@@ -39,6 +39,23 @@ services:
       # the 2025.8.2 -> 2026.8.2 upgrade, 2026-09-14.
       - ESPHOME_USERNAME=${ESPHOME_USERNAME}
       - ESPHOME_PASSWORD=${ESPHOME_PASSWORD}
+      #
+      # Device Builder 1.0.0 added a remote-build peer-link receiver that binds
+      # 0.0.0.0:6055 and advertises itself over mDNS as _esphomebuilder._tcp.
+      # It is ON BY DEFAULT — controllers/remote_build/_state.py declares
+      # `remote_builds_enabled: bool = True` — so nobody enabled it; it arrived
+      # with the rewrite. There is exactly one Device Builder here and builds
+      # run locally in this container, so the feature has no role: it is
+      # unrequested LAN reachability on a privileged host-network container
+      # whose job is writing firmware to devices.
+      #
+      # ⚠ This binds it to loopback; it does NOT disable it. The real off
+      # switch is a Settings toggle in the UI, and its enabled flag has no
+      # on-disk representation until it is changed, so there is nothing to set
+      # from a playbook without inventing a schema. Flip it in Settings and
+      # this line can go. (ha-dev's stated preference, correctly, is not
+      # enabling a feature over restricting its bind address.)
+      - ESPHOME_REMOTE_BUILD_HOST=127.0.0.1
     labels:
       - homepage.group=Apps
       - homepage.name=ESPHome