fix(e2e): reserve distinct corporate proxy fixture ports

[drew]

Summary

Reserve all four corporate proxy fixture ports simultaneously so allowed and denied endpoints cannot receive the same port. This removes a false security assertion failure observed in main-branch VM E2E.

Related Issue

No issue required: localized E2E fixture bug. See failing Release Dev run.

Changes

• Allocate four loopback listeners before reading their assigned ports.
• Keep the listeners alive until every port is selected, then release them for the fixture processes.

Testing

• mise run pre-commit passes
• mise run test passes
• VM E2E rerun (requires release E2E environment)
• mise run ci passes locally: Go gateway tests see an existing system gateway and fail their empty-directory assertions; unrelated to this Rust fixture change.

Checklist

• Follows Conventional Commits
• Commit is signed off (DCO)
• Architecture docs not applicable: test fixture only

[github-actions]

Label test:e2e applied for 43feeec. Open the existing run and click Re-run all jobs to execute with the label set. The run will execute the standard E2E suite after building the required gateway, sandbox, and supervisor images once. The matching required CI gate status on this PR will flip green automatically once the run finishes.