fix(run): alternate DNS stub port allocation

[LukeMathWalker]

Why

Windows maintains independent TCP and UDP excluded-port ranges. The host DNS stub could repeatedly choose TCP ports that UDP rejects with WSAEACCES, causing otherwise unrelated Windows CI jobs to fail, as seen in this run.

What Changed

• Alternate between UDP-selected and TCP-selected ephemeral port candidates.
• Keep the first socket open while binding the matching port for the other protocol.
• Increase the bounded search to 64 total candidates.
• Preserve errors from both allocation directions in the startup failure.

Risks / Notes

The failure depends on Windows-specific excluded-port configuration and cannot be reproduced in the Linux development environment. The existing cross-platform tests exercise startup, shutdown, loopback binding, and DNS responses over both UDP and TCP; Windows CI provides the platform-specific regression coverage.