fix(e2e): avoid gateway health port collisions

[drew]

Summary

Prevent E2E gateways from selecting the same ephemeral port for their API and health listeners. An expanded Linux run failed before managed Podman tests started when both probes returned port 37641.

Related Issue

Part of the #3583 stability campaign. This is a localized E2E harness race found by the expanded diagnostic run.

Changes

• Add a shared port picker that rejects previously selected ports.
• Use it for Docker and Podman gateway health listeners and Kubernetes health port forwarding.
• Document the harness port-selection constraint.

Testing

• Shell syntax checks for all changed scripts.
• Deterministic duplicate-then-distinct port picker check.
• mise run pre-commit.
• mise run ci.
• Expanded GitHub Actions diagnostic on this PR's stack tip.

Checklist

• Conventional Commit with DCO sign-off.
• Stacked with gh stack.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[drew]

Closing to narrow the automated flake investigation to the four selected fixes (#3583/#3588, #3598, #3604, #3608). The findings remain available here for later follow-up.