fix(network): product-truth rollback detector instead of kernel-port probing

[danshapiro]

What

Fixes the fourth base-gate flake (gate at 8255c0f, rust phase): network::tests::configure_rolls_back_the_listener_when_persist_fails burned all five of its environmental retries with "listener left on 0.0.0.0 after failed persist (no rollback), or a transient detector-bind artifact" — 5/5 identical, while passing isolated 15/15, full-binary 3/3, and under freshell-ws load 0/6.

Root cause

The wildcard-gone detector plain-bound 127.0.0.2:port and treated ANY failure as "the 0.0.0.0 listener survived." But the probe conflates OUR listener with anyone's on that port number: under the full parallel suite, the kernel reassigns the just-released port to sibling tests' wildcard listeners often enough that every retry attempt loses the lottery. The product's rollback itself is airtight (the handler awaits serve_on, which awaits the old accept loop's close barrier before replying).

Fix

RebindController now records its current listener's bound address (written under the same lock scope as the listener swap, after the new bind and the old close barrier), and the detector asserts that address is 127.0.0.1:port — an in-memory product-truth read with zero environmental exposure. A real rollback regression fails it deterministically, so the check upgrades from Env (retried) to Product (fail-fast). The serving probe (real connect to our own listener) stays Env for the documented WSL2 transient.

Mutation-checked: skipping the rollback rebind trips the new Product assertion. Full freshell-server suite 1007/1007 green; workspace clippy -D warnings clean; fmt clean.

Note

This intentionally touches production Rust (net_bind.rs) — rust-gate runs the full workspace suite.