test(daemon): give the twohost web owner seed control and a docs listener

The S4 twohost-web owner hosted broker IPC under an invented name and
never started seed control or a docs listener. ServeFor correctly asks the
canonical seed control for DocsStatus, so the owner could register the
reference but failed DOCS_PORT_DISCOVERY_FAILED before replying with a URL.

Use separate canonical broker and seed-control sockets on role B. Start
the real seed-control server, wait for its ping, bind a broker-backed
loopback listener on an ephemeral port, and require DocsStatus to report
that bound port. Stop and join the added control server on normal exit.
Keep role A and all helper, byte-equality, authorization and completion
expectations unchanged: A forwards B's returned URL and does not ask its
own seed-named broker for DocsStatus on this path.

The listener and discovery precondition carry
[int->REQ-WEB-URL-BOUND-PORT]. Scope and gate receipts live under
.spt/preserved/hertz-S4-twohost-seed-docs/. Windows unopted-in twohost_web
execution does not exercise the seven role-gated bodies; the S5 golden
owns the real cross-host proof.

Todlando's unchanged-S4 Linux discriminator reproduced the exact discovery
failure without seed control/listener (native 101), then returned Registered
at the actual bound port 33319 with those fixtures present (native 0).
Receipts: .spt/preserved/304-web-helper-rca/linux/.

Co-authored by: hertz