test(docshost): pin the bound docs port's publish gate and its retirement

REQ-WEB-URL-BOUND-PORT had impl, int and doc evidence and no unit evidence in
either lane; this is that cell.

It pins a DIFFERENT contract than the one specified, because the specified one
is false by design. The ask was Some(bound) after start_serving returns.
start_serving passes broker = None, and the publish lives inside
broker.as_ref().map(...), so a brokerless listener never stores and
bound_docs_port() stays None however successfully it bound. The module comment
above BOUND_DOCS_PORT says exactly that is the intent: standalone fixture
listeners must not advertise their ports as the daemon's serving surface.
Nothing tested it, and the failure mode is live -- hoist that store out of the
map and every temp-dir fixture listener in this suite advertises itself as the
daemon. So the cell asserts the gate: a real ephemeral bind, and None after it.

Retirement is asserted on the GUARD rather than through a server. BoundDocsPort
is held in the serving task for the lifetime of accept_loop, so a unit cell
cannot drop it without a stop handle and there is none to take. The round trip
(store, Some, drop, None) covers the 0-sentinel mapping in both directions,
which a one-way assert would miss, and the comment labels it as the reachable
half of the claim rather than as a server test.

The cell leaves BOUND_DOCS_PORT as it found it -- the guard's Drop restores the
0 default -- so it does not poison a sibling under bare cargo test, where it
would otherwise be order-coupled with any future reader of that global. Under
nextest's process-per-test it is isolated regardless.

Test-only. Compiled at these bytes: cargo test -p spt-daemon --lib --no-run
exit 0, zero errors, zero warnings. UNRUN at commit time; execution waits on
the gater's word.

Co-authored by: hertz
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GY7rT7iPXEDNb7FN18WX1K