test: guard test ports against the fetch bad-ports list

[vivek7405]

Follow-up to #1461, which re-based two dev-server test ports off 10080. That fixed those two files and nothing else: the next dev-server test starts from a copy of whichever neighbour is nearest, so the same range can come back.

Why guard the class

The cost of this bug is out of proportion to the typo behind it.

• It is deterministic given the pid, not timing-dependent. A re-run almost always goes green, so it reads as flake for as long as it survives, and re-running is the first thing anyone tries.
• The symptom points nowhere near the cause. dev-morph-verdict.mjs had the same exposure and fails as AssertionError: dev server never came up, while the server log captured in that same failure says webjs dev server ready on http://localhost:10080. The server is fine. The readiness poll simply cannot reach it, because fetch() refuses the port before opening a socket.

What it does

Reads the base + (process.pid % n) declarations out of the test sources, computes each reachable range, and fails if any range covers a port on the WHATWG Fetch bad-ports list.

It reads rather than imports, because these modules spawn a real dev server on import. Evaluating them here would cost minutes and, at the wrong pid, would be the very failure being guarded against.

The full list is included rather than just 10080, since a future test is free to base itself anywhere. 10080 is the highest entry, so any range above it is permanently safe, which is the rule #1461 moved the two files to satisfy.

The second assertion is the important one

It fails if the guard stops finding the declarations at all. Without it the first assertion passes vacuously the moment the idiom is respelled or moved to a helper, which is the same shape as the og-card fit pass that shipped with a condition that could never be false and silently guarded nothing for its whole life.

Verification

Both assertions were run against their counterfactuals:

change	result
none (current main)	both pass
revert dev-public-before-warm to 10000 + (pid % 256)	range assertion fails, naming the file, the range and 10080
break the pattern so nothing is found	vacuity assertion fails, reporting 0 found

Guard-only. No production code and no existing test is touched.