test(bastion): cover ownership-rejection reuse-guard branch (#1065 follow-up)

[rysweet]

Quality-audit follow-up to merged PR #1065

Merged PR #1065 hardened existing_live_tunnel_port with a process-tree ownership check so azlin code will not reuse a tunnel port when a stale/recycled registry pid points at a port now listened on by an unrelated process.

Finding (quality audit, MEDIUM — test gap): The security-critical rejection branch (Ok(false) => None) had no test. test_existing_live_tunnel_port_reuses_live_and_ignores_dead covers the reuse path (Ok(true)) and the pid-dead early exit, but the dead case returns before the ownership check ever runs — so the hijack defense that motivated the PR was untested and regression-prone.

Fix

Adds test_existing_live_tunnel_port_rejects_unowned_listener:

• Our own process owns the loopback listener for port.
• The registry entry credits a separate, live child pid whose downward process tree cannot contain our (parent) pid → ownership resolves to not owned → reuse must be refused.
• Guarded to assert only where listener ownership is inspectable (ss/lsof//proc), matching the documented platform fallback.

Validation

• New test passes deterministically across 5 consecutive runs.
• Full azlin bastion suite: 106 passed, 0 failed (was 105; +1).
• cargo build and cargo clippy clean for the changed file (0 warnings).
• Additive test only — no production behavior changed.

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com