test: verify remote export at the CLI boundary

[rustfuture]

Problem

grainx export --remote <url> panicked with Cannot drop a runtime in a context where blocking is not allowed because reqwest::blocking::Client was built inside #[tokio::main]. That was fixed in 3dfa107 by running the blocking request on a dedicated OS thread, with unit tests in src/metrics.rs. This PR adds the remaining CLI-boundary acceptance and a current demo record.

New behavior / tests

• New tests/cli_remote_export.rs spawns the real compiled binary via env!("CARGO_BIN_EXE_grainx") against a minimal std::net::TcpListener /metrics fixture. No new dependencies, no internet.
  • success: exit 0, both output files exist and parse; network_rx_bytes / network_tx_bytes stay byte counts (no rename to rates)
  • unreachable endpoint: exit 4, controlled remote metrics: ... error, no panicked / Cannot drop a runtime text
  • malformed JSON response: exit 4, controlled invalid metrics JSON error, no panic
  • http://127.0.0.1:0 (the exact historical repro): exit 4, controlled error
• New demos/verification_2026-09-11-remote-export.md: base commit, dirty count, toolchain, build command, binary SHA-256, exact capture commands, exit codes/outputs for all four cases, and remaining limits.
• demos/README.md: links the new record and marks the 5dde108 panic as historical (it is not presented as a success).

Test commands

cargo fmt --check
cargo check --locked --all-targets
cargo clippy --locked --all-targets -- -D warnings
cargo test --locked

All pass. cargo test --locked: 45 library + 2 bin + 4 cli_remote_export + 13 integration = 64 passed, 0 failed.

CLI captures against the frozen binary sha256 5e485df1469c1163db9b253794a30f7124b763969ea8abf39ae908584c7492b6:

Case	Exit	Panic text
success against live grainx agent	0	none
unreachable closed port	4	none
malformed JSON (HTTP 200)	4	none
http://127.0.0.1:0	4	none

Limits

• Loopback only: no TLS, proxy, redirect, auth, non-200, slow-endpoint, or large-body coverage claimed.
• The malformed case is schema-invalid JSON in an HTTP 200 body; non-200 handling is implemented but not asserted here.
• Values in the success capture are one host sample, not a benchmark.
• No source changes: src/metrics.rs and src/ui.rs are untouched.