feat: select open port on firecrest remote sessions

[SalimKayal]

Summary

Remote FirecREST sessions on Slurm now pick free local TCP ports for the session, git proxy, and git-proxy health endpoints instead of hardcoded defaults, while keeping the standard ports the Amalthea controller connects to. This prevents collisions between co-located sessions that share the host network namespace.

Motivation and context

Enroot on the cluster shares the host network namespace, so multiple sessions scheduled on the same node collide on the previously fixed ports (RENKU_SESSION_PORT=8888, GIT_PROXY_PORT=65480, GIT_PROXY_HEALTH_PORT=65481). One session's wstunnel/git-proxy listener would fail to bind or clash with another's, breaking session startup and git operations on multi-tenant nodes.

Behavior

• A new find_free_port helper probes the 20000–31999 range by briefly binding with nc, skipping
  ports already chosen for this session, and errors out (with a stderr diagnostic) if none is free.
• Each service now has a locally-selected free port and a fixed remote port:
  • RENKU_SESSION_PORT (free) / RENKU_SESSION_REMOTE_PORT (8888)
  • GIT_PROXY_PORT (free) / GIT_PROXY_REMOTE_PORT (65480)
  • GIT_PROXY_HEALTH_PORT (free) / GIT_PROXY_HEALTH_REMOTE_PORT (65481)
• The wstunnel command is rewired so the Amalthea-facing ports stay on the standard defaults while
  the node-local binds move to the free ports (-R exposes the standard remote port forwarding to
  the free local session port; -L binds the free local port forwarding to the standard remote
  git-proxy ports).
• For cloned repos, the git config copied from k8s (hardcoded 65480) is overridden per repo with
  http.proxy http://localhost:${GIT_PROXY_PORT} and http.sslVerify false before git fetch, so
  fetches route through this session's local proxy listener.

Changes

• internal/remote/firecrest/session_script.sh
  • Added find_free_port function.
  • Split session/git-proxy/git-proxy-health ports into local (free) and remote (standard) variables
    and exported them.
  • Updated the wstunnel client invocation (and its debug echo) to use the new variables.
  • Override http.proxy and http.sslVerify per repo before git fetch.
  • Emit an error to stderr when no free port is found.

Notes

• The port probe assumes nc and timeout are present in the remote session image (already a
  dependency of this script's environment).
• No automated tests cover this shell script; recommend manual verification on a node running
  multiple concurrent sessions.