Fix port auto-allocation on host conflict

[alistair3149]

Follows-up to #811

The promise of make dev "just works" across worktrees was not being kept:
since .env.dist ships MW_SERVER_PORT=8484, every fresh clone hit the
"explicit request" branch in set-port.sh on first run and skipped the
host-port-free check, so a busy 8484 (or any second worktree) failed at
docker compose up with a cryptic bind error.

Commits

1. Fix port auto-allocation on host conflict

Three fixes, scoped to the same code path:

• Makefile ensure-port: skip allocation when our compose stack is
  already running, so an idempotent make dev re-run does not silently
  reallocate and force-recreate the live mediawiki container. When the
  stack is down and no port= override is given, pass empty string to
  set-port.sh so the existing allocate() logic (reuse if free, else
  range-scan) actually runs.
• set-port.sh explicit-request branch: validate that the requested
  port is free and exit with a clear error if not, rather than writing
  it back and letting docker bind fail later with an opaque message.
• set-port.sh allocate(): when the existing .env value is held
  AND outside the configured range, treat it as a deliberate user
  override and error out instead of silently swapping it for an
  in-range port.

2. Add Docker/tests/ with smoke test rename and set-port regression suite

Establishes Docker/tests/ as the home for shell-script tests at the
Docker layer, keeping the top-level tests/ subtree PHP-only.

• Docker/test.sh → Docker/tests/smoke.sh. Renamed (was an ambiguous
  "test.sh") and now resolves .env relative to the script so it can
  be invoked from anywhere.
• Docker/tests/test-set-port.sh locks in the coverage matrix as an
  executable regression suite. Uses python3 to hold contested ports
  (backlog 128 + accept-and-close loop), allocates into a high MW range
  (38484-38499) so a busy 8484-8499 on the host does not perturb
  assertions.
• make test-scripts runs the regression suite. Kept out of
  make test / make ci so it does not become a CI gate on the first
  iteration. Promote to CI after a few sprints once stability is
  confirmed.

Heads-up: PR #818 references Docker/test.sh in its planned
smoke-test target — that path becomes Docker/tests/smoke.sh after
this PR lands. (Will leave a note on #818.)

Coverage matrix

Scenario	Before	After
Fresh clone, 8484 free	works	works
Fresh clone, 8484 held by other	fails at docker bind	auto-picks next free in range
Second worktree, baked .env=8484, A holds it	fails at docker bind	auto-picks next free in range
Re-run while stack up	works	works (gate skips allocator, no recreate)
port=N, N free	works	works
port=N, N held by other	fails at docker bind	clear error, exits 1
Manual .env=9999, 9999 free	works	works (preserved)
Manual .env=9999, 9999 held	fails at docker bind	clear error, exits 1

Test plan

• All 11 checks in make test-scripts pass.
• Coverage matrix above verified against a sandboxed .env with python TCP listeners holding the contested port for each row.