Keep fixed CI service ports outside the ephemeral range

A fixed Docker service port can collide even on an otherwise isolated Linux CI runner when that port lies inside the operating system's ephemeral allocation range. Prefer a fixed port outside the configured ephemeral range, or reserve and probe the port before starting the service. Treat a bind failure before tests as infrastructure contention, then rerun the whole workflow if downstream jobs consume attempt-scoped artifacts. A retry clearing the problem supports contention but does not identify the original socket owner, so verify the range and runner activity before making a permanent port change.

Applies when: CI starts local services on fixed host ports while other network activity is concurrent. Keywords: Docker Linux CI fixed port ephemeral range bind collision runner