Add opt-in service discovery: local listeners and rate-limited private subnet scans

Reports identified services (HTTP, HTTPS, SSH, SMTP, FTP, ...) to Hammerhead as
suggested targets. Needs a Reef release containing model.DiscoveredService.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -7,6 +7,13 @@ BAMBOO_TOKEN=
 # Report local Docker containers so they can be picked as targets.
 #BAMBOO_DOCKER=1
 
+# Report services listening on this machine (Linux) as suggested targets.
+#BAMBOO_DISCOVER=1
+# Also scan these private subnets (comma separated, each at most a /22), on these ports, at most this many connections per second.
+#BAMBOO_DISCOVER_SUBNETS=192.168.1.0/24
+#BAMBOO_DISCOVER_PORTS=22,80,443,8000-8010
+#BAMBOO_DISCOVER_RATE=50
+
 # Folder for this agent's WireGuard key.
 #BAMBOO_DATA=./bamboo-data