deploy: never start the replacement while the predecessor holds the port

The 2026-09-16 halogen restore failed exactly here. The ik root unit stopped,
systemd logged "Deactivated successfully", pasta tried to bind 7770 about a
second later, reported "Address already in use", and the quadlet exited 126.
Only Restart=on-failure recovered it -- minutes later, which is not a deploy.

The handler now waits for every socket on the port to clear (listener, accepted
and TIME_WAIT) before installing and starting the quadlet, and fails loudly with
the socket table attached if it never does. The retirement also reports when the
unit file was already gone, because this host's `disable` deletes it.

tests/frank_large_unit.bats

@@ -102,3 +102,12 @@ REMOTE_DEPLOY="$REPO_ROOT/scripts/deploy-remote.sh"
     [ ! -e "$REPO_ROOT/scripts/frank-large.service" ]
     [ ! -e "$REPO_ROOT/scripts/serve-frank-large.sh" ]
 }
+
+@test "the deploy handler waits for the predecessor to release the port" {
+    # The 2026-09-16 cutover failed at exactly this: the ik server's socket was
+    # still on 7770 when pasta tried to bind it ("Address already in use"), and
+    # the container died on it. Restart=on-failure recovered minutes later, but
+    # a deploy that starts a doomed container has not deployed anything.
+    grep -q 'wait_port_free 7770' "$REMOTE_DEPLOY"
+    grep -q '^wait_port_free() {' "$REMOTE_DEPLOY"
+}