What review found in the port machinery, fixed

Three faults, one file split. All from reading, all verified to bite.

Unassign now releases the module's ports. ReleasePorts existed, said
"for when it is unassigned" in its own comment, and was called by
nothing — so a fixed port stayed claimed in the name of a module that
was gone, and the next module needing it was refused by a ghost.
Kept-once-chosen is a promise about a module that is still here.

MachineSide reads addressed mappings. "127.0.0.1:8080:80" was split at
the first colon, "127.0.0.1" failed to parse as a port, and the mapping
was silently skipped — putting the filter back on the declared port,
the exact fault the function was written to end. The machine side is
the second-from-last part, which is the reading the host already
applies, and the substrate bundle writes that shape today.

An allocation race answers in the mesh's words. Two concurrent picks of
the same port used to surface as a Postgres constraint violation,
verbatim. The table has two keys, so the collision is one of two facts:
the racer was this same assignment — then its answer is the answer,
kept-once-chosen does not care who chose — or another module took the
machine port, and an unfixed pick is simply made again against the
moved free list. A fixed port that lost the race is refused by name.
Told apart by re-reading the row, not by the constraint's name, so this
does not couple to the migration's spelling.

And the artifact-store cycle tests moved to bootstrap_cycle_test.go;
machineside_test.go had quietly become three subjects.

internal/inventory/ports_test.go

@@ -211,3 +211,28 @@ func TestWhatAMachineNoLongerHoldsIsAvailableAgain(t *testing.T) {
 		t.Errorf("a port the machine gave back was still reserved: got %d", got.Machine)
 	}
 }
+
+// Unassigning a module gives its ports back — the fixed ones are what make this matter.
+//
+// Held past unassignment, port 25 stays claimed in the name of a mail system that is gone, and
+// every mail system after it is refused by a ghost. Found in review: ReleasePorts existed, was
+// documented "for when it is unassigned", and was called by nothing.
+func TestUnassigningReleasesTheModulesPorts(t *testing.T) {
+	inv, node := aNodeWithModules(t, "mailu", "other-mail")
+	ctx := t.Context()
+	if err := inv.Assign(ctx, node, "mailu"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.PortFor(ctx, node, "mailu", 25, true); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.Unassign(ctx, node, "mailu"); err != nil {
+		t.Fatal(err)
+	}
+	if err := inv.Assign(ctx, node, "other-mail"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := inv.PortFor(ctx, node, "other-mail", 25, true); err != nil {
+		t.Fatalf("port 25 is still held in the name of a module that was unassigned: %v", err)
+	}
+}