deploy: stop the frank-medium unit before waiting for port 7770

The port gate was written for the cutover, when the vLLM proxy held 7770. Once
frank-medium itself owns the port, a re-deploy waits 90s for a socket that only
its own predecessor is holding and fails: 'FAIL: port 7770 is still held after
90s', with the old llama-server still serving scrapes. Stop the unit first, then
sweep a stray manual llama-server (the shape a benchmark harness leaves behind);
pkill -x, never -f, so the deploying shell cannot match itself.

scripts/deploy-remote.sh

@@ -1156,10 +1156,20 @@ deploy_llm_medium() {
     [[ "$missing" -eq 0 ]] || return 1
 
     retire_vllm_medium_quadlets
-    # The retired proxy held 7770 on the host network; pasta releases it at
-    # container teardown and a stopped engine lingers in TIME_WAIT just past
-    # that. Same gate as frank-large's cutover (2026-09-16 addressed-in-use
-    # failure).
+    # The thing holding 7770 is now THIS service: on a re-deploy the previous
+    # llama-server is still bound to it, so waiting for the port without
+    # stopping the unit deadlocks the deploy (measured 2026-09-16: "FAIL: port
+    # 7770 is still held after 90s", with the old server happily serving a
+    # scrape). Stop the unit first, then sweep a stray manual run of the same
+    # binary -- that is how a benchmark harness leaves the port busy. `pkill -x
+    # llama-server` matches the process name exactly and can never match the
+    # deploying shell; never `pkill -f` here.
+    run_privileged systemctl stop frank-medium.service 2>/dev/null || true
+    pkill -x llama-server 2>/dev/null || true
+    sleep 2
+    # pasta released the retired proxy's socket at container teardown, and a
+    # stopped engine lingers in TIME_WAIT just past that. Same gate as
+    # frank-large's cutover (2026-09-16 addressed-in-use failure).
     wait_port_free 7770 || return 1
     relink_unit frank-medium
     run_privileged systemctl daemon-reload