fix(shell): avoid docker SSH port collisions and improve docker compose hints

[skulidropek]

Summary

• treat Docker-published host ports as reserved during SSH port selection (not only raw TCP bind checks)
• keep port selection deterministic by merging project index reservations + docker ps published ports
• improve DockerCommandError user hint with explicit recovery for port is already allocated (--ssh-port <port> or stop conflicting container)

Why

Docker can reserve host ports via NAT while no host socket is visible. In that case isPortAvailable() may return a false free signal and docker compose up fails later with Bind for 127.0.0.1:<port> failed: port is already allocated.

Validation

• pnpm -C packages/lib test
• pnpm -C packages/lib typecheck
• pnpm --filter ./packages/app build:docker-git
• manual repro: pnpm run docker-git clone https://github.com/ProverCoderAI/docker-git/issues/65 --force now auto-reassigns 2222 -> 2225 and starts successfully

Mathematical Guarantees

• Invariant: if a host port is already published by any running Docker container, the allocator does not select it
• Invariant: error message for compose failure includes actionable recovery for port allocation conflicts

Related: #66

[skulidropek]

#65