fix(cli): harden managed service election

[kitlangton]

What

Prevent stale or unresponsive managed-port owners from trapping service contenders, while preserving correct ownership during slow and highly concurrent startup. Incumbent recognition now has a true 15-second wall-clock bound, and only the process that wins the port bind persists the generated service password.

Before / After

Before: incumbent recognition allowed 60 retries, but each authenticated health probe could take two seconds, stretching an intended short retry window to roughly two minutes. A strict six-second replacement proved too short under Windows CI and misclassified a legitimate owner that published registration after seven seconds. Concurrent first-start contenders also generated and wrote passwords before election; they raced on the shared config temp file, causing ENOENT, and could persist a loser password that did not authenticate the elected service.

After: recognition is interrupted after 15 seconds regardless of probe latency. A legitimate owner may publish registration eight seconds after the bind race begins and is still recognized; a stale registration plus a listener that never answers health fails with an actionable conflict in bounded time. Passwords are generated in contender memory but persisted only in the elected owner’s onListen path, before registration, so config and registration always carry the same credential.

How

• packages/cli/src/server-process.ts: bound the complete incumbent-recognition retry operation with Effect.timeoutOption("15 seconds").
• packages/cli/src/server-process.ts: defer first-time password persistence until after successful port binding and before publishing registration.
• packages/cli/test/service.test.ts: model a stale registration whose exact-port listener accepts health requests but never responds.
• packages/cli/test/service.test.ts: deterministically wait until post-bind incumbent polling begins, delay registration for eight seconds, and verify successful adoption.
• packages/cli/test/service.test.ts: require all election losers to exit successfully, include their output in failures, verify persisted and registered passwords match, preserve empty-password generation behavior, and prevent cleanup assertions from masking the primary failure.
• packages/cli/test/service.test.ts: bind foreign listeners explicitly to 127.0.0.1 so the reproducer is deterministic on macOS.

Scope

This builds on the port-bind election and registration lease introduced by #37572 and #37576. It deliberately does not kill an unknown port owner: without a matching authenticated registration, signaling that PID could terminate an unrelated or PID-reused process. The safe outcome is a bounded, actionable conflict.

Testing

• bun run test test/service.test.ts in packages/cli (17 passed)
• bun run test test/service.test.ts --test-name-pattern "concurrent service processes elect one server" --rerun-each 20 in packages/cli (20 passed)
• bun run test test/service.test.ts test/promise-service.test.ts in packages/client (15 passed)
• bun typecheck in packages/cli
• push hook full-repository typecheck (32 packages passed)

The prior Windows run also hit an unrelated packages/core/test/vcs.test.ts timeout at 5006.92 ms against a 5000 ms default; no files in that package are changed here.