refactor(serve): reach three admission decisions without their IO

Split the decision half out of each of the three sites hertz measured as unreachable without a live query: bootstrap firewall verification on Windows, the docs-port reply, and the port-discovery fallback predicate. Each becomes a pure function over evidence its caller has already read, leaving the original function as its IO plus one call. No trait, no injection, no new dependency, and no behavior change. Deactivate the bootstrap firewall's integration stage, which has no two-machine rig, and name the field acceptance that carries its obligation instead.

Co-authored by: todlando