fix(cli): avoid Chromium-restricted ephemeral ports

[miguel-heygen]

Summary

• add a reusable Chromium restricted-port predicate based on the upstream kRestrictedPorts list
• close and rebind static snapshot/check servers when listen(0) selects a browser-blocked port
• cap rebinding attempts and clean up error listeners and rejected listeners

Regression coverage

• recognizes restricted port 3659 and allows a representative safe ephemeral port
• retries an unsafe assignment and preserves the first safe assignment
• verifies bounded retry exhaustion closes the listener without leaking error handlers
• preserves existing static server range and asset-root behavior

Verification

• bun run --cwd packages/cli test (1,752 passed, 2 skipped)
• bun run --cwd packages/cli typecheck
• pre-commit lint, format, fallow, and tracked-artifact checks