Harden audio wave dispatcher default host

[osurmach]

Summary

Updates the audio-wave avatar example dispatcher to bind to localhost by default instead of all interfaces.

Why

The dispatcher exposes a /launch endpoint that accepts LiveKit room connection data and starts local worker subprocesses. For an example intended to run locally, binding to localhost is a safer default and avoids unintentionally exposing the endpoint on the local network.

This is a defense-in-depth change for the example default. The subprocess call uses an argv list, and this change is not intended to address command injection.

Changes

• Default dispatcher host changed to 127.0.0.1
• External binding remains possible through explicit configuration
• Added/updated comments or documentation to explain when to use 0.0.0.0

Testing

• Ran the audio-wave avatar example locally with the default host
• Verified the dispatcher still starts and /launch works from localhost

[CLAassistant]

All committers have signed the CLA.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.