Guard start paths with the ss-free port probe too

Why: check_port_free consulted port_owner (ss -ltnp) only, so the
/dev/tcp fallback added to port_listening never ran on the start path;
CI (no iproute2) still started onto a thief-held port.

Evidence: no-ss simulation refuses a bound port and passes a free one;
full suite 10/10 and make test-governance rerun recorded on the card;
CI on the new head is authoritative.

Impact: scripts/svc.sh check_port_free only.

Refs: .task/feature-svc-autorecover.md

scripts/svc.sh

@@ -878,6 +878,13 @@ check_port_free() {
     c_err "处理：停掉该进程，或换端口（--port / --addr）"
     return 1
   fi
+  # ss 不可用时 port_owner 为空——再经 port_listening（含 /dev/tcp 兜底）确认，
+  # 否则无 iproute2 的环境里启动守卫完全失明（CI 容器实测）。
+  if port_listening "${ENV_ADDR##*:}"; then
+    c_err "[$ENV_NAME] 端口 ${ENV_ADDR##*:} 正被监听（未能识别占用者；无 ss 时仅能探测不能归因）"
+    c_err "处理：停掉该进程，或换端口（--port / --addr）"
+    return 1
+  fi
 }
 
 # ---- 服务配置解析（CLI > 配置文件/环境变量 > svc.env 持久化 > 默认）----