Clarify the host, firewall, and agent network flow in the README

[jimpudar]

Summary

• Reworked the README network diagram to be provider-agnostic and role-based: Host, Firewall VM, Agent VM, and Internet.
• Made the no-direct Host-to-Agent path explicit and showed host access going through firewall SSH ProxyJump.
• Clarified that the agent’s DNS/HTTPS/SSH egress stays on the private L2 link and that the agent VM description is generic.

Testing

• Not run (not requested)

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews