feat(services): MySQL, and the port allocator every service now shares (T34c)

[haiquang9994]

MySQL — the second database product rather than a second version of the first — and the port
allocation that came with it and now belongs to every service. Roadmap task T34c; phase 3 is
13 of 15.

One allocator decides every service's port

A recipe declares the port it would prefer; service.create allocates one under a lock held across
the INSERT, so two creates racing cannot be handed the same number. Free means free on the
machine, not free in the table — the test is a bind, so a port an XAMPP is already holding is not
handed out and is reported with that program's name rather than renumbered in silence. The number is
written once and never recomputed.

services::pools::free_port went into it: a php-fpm pool asks for its 9000 by the same rule
mariadb@main asks for 3306. ServiceSummary carries the port now, and service.create answers a
ServiceCreation — the service, plus why it is not on the port it asked for — because a port a
person did not choose is one they have to be told about.

The MySQL recipe

Most of the machinery is T33's, reused rather than rebuilt: Recipe::ritual, ReadyCheck::Command
as an authenticated mysqladmin ping, StopBehaviour::Command as mysqladmin shutdown, and the
markers that let a half-finished data directory be cleaned without ever clearing a database
MixEngine did not create.

The bootstrap is a table of three routes and not a version test, and the route is an argument
rather than a cfg! — so all three are exercised wherever the tests run, where two of them would
otherwise be unreachable on any one machine: mysqld --initialize-insecure from 5.7 on;
mysql_install_db for 5.6 on Unix, run by the interpreter its own first line names; and 5.6 on
Windows copying the data/ directory upstream's zip ships built.

What the task did not expect to add is Step::secret_file. MySQL removed --bootstrap at
5.7.6, so the statement setting the root password cannot travel on standard input the way MariaDB's
does — --init-file takes a path. The three ways to get a generated password into that server are
a file, an argument list every process can read, or a temporary server on a port anybody can connect
to; only the first has an exposure MixEngine bounds. So a step may declare a file, the daemon writes
it inside owner-only run/ and removes it whether the step succeeded, failed or timed out, and its
content never reaches a Debug line.

Two measurements changed the template. --initialize-insecure creates only root@localhost
where MariaDB's installer creates four root rows, so skip-name-resolve could not travel from one
my.cnf to the other — and the suite's refusal assertion, which reads back 'root'@'localhost', is
what proves the lookup is still on. And a modern MySQL opens a second listener nobody asked for, the
X Protocol on 33060, which no allocation handed out and no services row records; loose-mysqlx = OFF closes it on 8.0 and newer and is a warning rather than a refusal on the two 5.x lines.

Judged against a real server

crates/mixengine-cli/tests/mysql.rs installs a real 8.4.10 and asserts what only a server can say:
the first start bootstraps an empty data directory, the service reaches running — an authenticated
ping, and therefore proof the generated password reached the keyring and came back — root without a
password is refused by name, the stop is a clean shutdown in the server's own log, a second start
does not bootstrap again, and a data directory MixEngine did not create is refused rather than
cleaned.

CI fetches MySQL on every runner that has one. There is no Windows-on-ARM cell in any MySQL line, so
that leg skips the step rather than failing a download that could not succeed; the Linux leg runs
inside the keyring namespace, for MariaDB's reason.

CI on this branch is green on all seven jobs, real-server suites included.