Keep fixed CI service ports outside the ephemeral range
A fixed Docker service port can collide even on an otherwise isolated Linux CI runner when that port lies inside the operating system's ephemeral allocation range. Prefer a fixed port outside the configured ephemeral range, or reserve and probe the port before starting the servic…