deploy: never start the replacement while the predecessor holds the port

The 2026-09-16 halogen restore failed exactly here. The ik root unit stopped,
systemd logged "Deactivated successfully", pasta tried to bind 7770 about a
second later, reported "Address already in use", and the quadlet exited 126.
Only Restart=on-failure recovered it -- minutes later, which is not a deploy.

The handler now waits for every socket on the port to clear (listener, accepted
and TIME_WAIT) before installing and starting the quadlet, and fails loudly with
the socket table attached if it never does. The retirement also reports when the
unit file was already gone, because this host's `disable` deletes it.

tests/frank_small_unit.bats

@@ -52,7 +52,9 @@ QUADLET_LARGE="$REPO_ROOT/dankclaw/frank-large/quadlet/frank-large.container"
     # MTP tensors at all, so MTP is a property of the file, not of the flags.
     grep -q '^MODEL_FILE=.*-mtp\.gguf$' "$ENV_FILE"
     # A separate draft model would load a second 12 GiB copy of a 12 GiB model.
-    ! grep -q -- '--model-draft' "$SERVE"
+    # Only the effective configuration counts: the script's own comment explains
+    # why there is no draft path, and a textual grep would match that prose.
+    ! grep -vE '^[[:space:]]*#' "$SERVE" | grep -q -- '--model-draft'
 }
 
 @test "frank-small carries the fleet's image path, and only it" {