fix(remote): ignore polluted host attributes; audit surfaces them

resolveProxmoxHostSlug trusted attributes.host verbatim, so a value polluted
with prose — lxc:teddycloud carried host="hubris (confirmed via pct config…)" —
became a slug that never resolved, leaving its checks 'down' despite a correct
`hosts` edge. Treat an attribute containing whitespace/parens as invalid and
fall back to the canonical hosts edge.

The audit now reports `polluted_attrs` — entities whose routing-critical
attributes carry prose — so this class is visible instead of a silent
resolution failure.

internal/audit/audit.go

@@ -88,6 +88,14 @@ func Report(ctx context.Context, pool *db.Pool) ([]Finding, Summary) {
 			   AND src.state NOT IN ('destroyed','deprecated')
 			   AND tgt.state IN ('destroyed','deprecated')`,
 		},
+		{
+			Finding{Category: "polluted_attrs", Severity: "warning",
+				Evidence:         "routing-critical attributes carrying prose (breaks resolution) — e.g. host='hubris (confirmed via pct…')",
+				SuggestedRunbook: "knowledge-graph-audit"},
+			`SELECT slug || ': host=' || (attributes->>'host') FROM entities
+			 WHERE attributes->>'host' IS NOT NULL
+			   AND (attributes->>'host') ~ '[ (]'`,
+		},
 	}
 
 	findings := make([]Finding, 0, len(specs))