fix(ci): recover relay opens and isolate VM proxy ports

[drew]

Summary

Recover relay opens after supervisor reconnect and prevent VM proxy fixture port collisions. Clean restack of #3583.

Related Issue

No issue required: localized fixes for the Docker sync and VM proxy failures cited in #3583.

Changes

• Replay unclaimed relay opens after each accepted supervisor session.
• Give VM proxy fixtures distinct ports and allow the host supervisor its required /proc access.
• Document reconnect replay behavior.

Testing

• Original focused Docker sync and VM proxy E2E runs passed in fix(ci): recover relay opens and isolate VM proxy ports #3583.
• mise run pre-commit passed on this restacked branch.
• Combined mise run ci fails in Go gateway-list tests because this host has /etc/openshell/gateways/default; see test(go): isolate gateway listing from host config #3590.

Checklist

• Conventional, signed-off commit.
• Architecture documentation updated.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[elezar]

Cross-reference: #4011 has been approved and submitted to the merge queue. It covers the pending-relay reconnect recovery originally implemented in #3583 and restacked here, together with duplicate-delivery suppression from #3588/#3619. It adds atomic enqueue/session validation, a shared setup deadline, SSH proxy shutdown/error propagation, and bounded Docker diagnostics.

Draft #3766 remains the follow-up for deterministic reconnect conformance coverage: rebase it after #4011 merges and remove the overlapping server fix while retaining the tests and architecture documentation. The VM fixture changes here are separate from #4011, and the underlying Docker startup stall remains unresolved.