What review found in the port machinery, fixed

Three faults, one file split. All from reading, all verified to bite.

Unassign now releases the module's ports. ReleasePorts existed, said
"for when it is unassigned" in its own comment, and was called by
nothing — so a fixed port stayed claimed in the name of a module that
was gone, and the next module needing it was refused by a ghost.
Kept-once-chosen is a promise about a module that is still here.

MachineSide reads addressed mappings. "127.0.0.1:8080:80" was split at
the first colon, "127.0.0.1" failed to parse as a port, and the mapping
was silently skipped — putting the filter back on the declared port,
the exact fault the function was written to end. The machine side is
the second-from-last part, which is the reading the host already
applies, and the substrate bundle writes that shape today.

An allocation race answers in the mesh's words. Two concurrent picks of
the same port used to surface as a Postgres constraint violation,
verbatim. The table has two keys, so the collision is one of two facts:
the racer was this same assignment — then its answer is the answer,
kept-once-chosen does not care who chose — or another module took the
machine port, and an unfixed pick is simply made again against the
moved free list. A fixed port that lost the race is refused by name.
Told apart by re-reading the row, not by the constraint's name, so this
does not couple to the migration's spelling.

And the artifact-store cycle tests moved to bootstrap_cycle_test.go;
machineside_test.go had quietly become three subjects.

internal/inventory/catalogue.go

@@ -283,7 +283,11 @@ func (i *Inventory) Unassign(ctx context.Context, nodeName, module string) error
 	if tag.RowsAffected() == 0 {
 		return fmt.Errorf("%s is not assigned to %s", module, nodeName)
 	}
-	return nil
+	// And its ports go back. Kept-once-chosen is a promise about a module that is still here —
+	// held past unassignment, a fixed port stays claimed in the name of something that is gone,
+	// and the next module needing it is refused by a ghost. The same argument that lets a machine
+	// take a carried port back: a set that only grows keeps a port reserved for nothing.
+	return i.ReleasePorts(ctx, nodeName, module)
 }
 
 // Assigned is what a person put on this node, which is not the same as what it runs: resolution