fix(demo): recover startup from port and agents dependency failures

[felipetruman]

Summary

Fixes two failures in the local demo startup path: host-port conflicts now recover automatically, and the agents image now declares the cryptography runtime dependency required by the credential vault. The demo Compose project is isolated from unrelated stacks, startup retries port-bind races up to three times, and Docker build smoke checks prevent a broken CFFI/vault image from being published again.

Type of change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactor / tech debt
• CI / infra change

Related issues

No linked issue; reproduced locally through the documented demo command.

Changes

• Allocate and export the agents host port, reserve selected fallback ports, and retry Docker Compose startup when the daemon reports a bind conflict.
• Give the demo an explicit Compose project name so unrelated containers are not treated as orphans.
• Declare cryptography as an agents runtime dependency, update the Poetry lockfile and fallback installer, and smoke-import CFFI/Fernet/CredentialVault during image builds.
• Declare respx in the agents dev group so the documented full service test command is reproducible.

Testing

• Unit tests added / updated
• Integration tests pass locally
• Manually tested (describe steps below)

Manual test steps

1. Kept host port 8001 occupied and ran pnpm aisoc:demo --no-pull --no-open; agents automatically remapped to 8002 and Compose startup completed.
2. Built services/agents as aisoc-agents:cffi-fix and verified cryptography 49.0.0, cffi 2.0.0, and the credential-vault import inside the image.
3. Recreated the live agents service from the fixed image; it remained running with restart count 0 and its health endpoint returned healthy.
4. Ran the complete agents suite: 833 passed, 2 skipped, 30 subtests passed.

Screenshots (if UI changes)

Not applicable; no UI changes.

Checklist

• My code follows the style guidelines of this project (ruff, eslint, gofmt)
• I have performed a self-review of my own code
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally
• I have updated documentation as needed (no documentation changes required)
• My changes do not introduce new linter warnings
• I have checked for sensitive data / credentials in my diff

Eval harness (required for substrate / playbook / detection changes)

Both runs use the repository's fixed 200-incident synthetic benchmark. These are deterministic substrate gates, not live production measurements.

Before (origin/main at 9605121)

mitre_accuracy               0.970  PASS (macro 0.964)
alert_reduction              0.753  PASS
investigation_completeness   0.943  PASS (macro 0.943)
response_quality             1.000  PASS (macro 1.000)
hunt_corpus                  1.000  PASS
adversary_eval               0.475  PASS
confidence_calibration       0.060  PASS
memory_recall                1.000  PASS
override_accuracy            1.000  PASS
playbook_completion_rate     0.735  PASS
detection_fp_rate            0.005  PASS
PASS - ALL GATES GREEN

After

mitre_accuracy               0.970  PASS (macro 0.964)
alert_reduction              0.753  PASS
investigation_completeness   0.943  PASS (macro 0.943)
response_quality             1.000  PASS (macro 1.000)
hunt_corpus                  1.000  PASS
adversary_eval               0.475  PASS
confidence_calibration       0.060  PASS
memory_recall                1.000  PASS
override_accuracy            1.000  PASS
playbook_completion_rate     0.735  PASS
detection_fp_rate            0.005  PASS
PASS - ALL GATES GREEN

• No axis regressed
• An axis regressed; rationale and follow-up are described in the Summary above