Scenario 27: competing service steals port after launch → bootstrap
detects PID mismatch and reassigns to next free port.
Scenario 28: our openclaw owns the port → no reassignment needed.

- desktop-ci-check.mjs: update health probe URL from 18789 to 50789
- dev-launchd.sh: update OPENCLAW_PORT default to 50789 so cleanup
  no longer kills a user's unrelated global openclaw on 18789

- Replace lsof-based port detection with net.connect — lsof is blocked
  by macOS hardened runtime in packaged Electron apps, silently returning
  empty results even when ports are occupied.
- Add structured logging via env.log callback so bootstrap diagnostics
  appear in cold-start.log (console.log is lost in packaged mode).
- Fix recovery: add waitForExit after bootout before re-bootstrapping
  to prevent launchd race conditions.

Verified: packaged app correctly detects port 50789 occupied by global
openclaw, auto-assigns 50790, both services coexist.

…8789

The openclaw plist ProgramArguments never included --port, so openclaw
always bound to its hardcoded default 18789 regardless of what
findFreePort allocated. When another service (ClawX, global openclaw)
occupied 18789, our openclaw crashed on bind (EADDRINUSE) even though
bootstrap had correctly detected the conflict and assigned a new port.

Now passing --port explicitly in ProgramArguments. Also reverted the
default port back to 18789 since dynamic port allocation handles
conflicts correctly.

Simulates a global openclaw (or ClawX) occupying port 18789 before
Nexu launches. Verifies:
- Nexu detects the conflict and auto-assigns an alternative port
- Controller comes up healthy
- OpenClaw runs on 18790+ instead of crashing
- The blocker on 18789 is NOT killed (coexistence)

Green card on pass, red card on failure. Shows test mode, source,
channel, and links to the CI run for details.

Only sends on failure (not success). Card includes:
- Trigger source: PR number, branch, commit SHA
- Who triggered it
- Test mode/source/channel
- Link to CI logs

When launchd has stale state for a service label (e.g. after repeated
bootout/bootstrap during port conflict recovery), bootstrap fails with
'Input/output error (code 5)'. Now detects this error, bootout to
clear the stale registration, waits 1s, and retries once.

1. Recovery uses bootoutAndWaitForExit (captures PID before bootout)
   instead of separate bootout + waitForExit without knownPid.

2. Attach path adds token validation: checks launchd service env
   OPENCLAW_GATEWAY_TOKEN matches expected token before attaching.
   Prevents attaching to a global openclaw or ClawX on the same port.

3. E2E openclaw port conflict: controller readiness is now a hard
   fail. Port discovery uses runtime-ports.json instead of hardcoded
   range, so any valid auto-assigned port is accepted.

Scenario: start app normally on 18789, kill openclaw, occupy 18789
with a blocker, force-quit and re-launch. Verifies the app detects
the stolen port on cold start, auto-assigns a new port, and recovers.

This covers the post-launch recovery path that unit tests can't
easily simulate (requires real launchd timing).