fix(swe): resolve tool server startup failures with port allocation, retries, and shell fallback

[echobt]

Summary

Fix the Docker sandbox tool server failing to start in all containers during concurrent pipeline execution, eliminating the pervasive "Tool server health check failed after 3s, tools may not work" warnings.

Changes

Port Allocation (docker_sandbox.rs)

• Replace timestamp-based port derivation with a global AtomicU16 counter (NEXT_PORT) that guarantees unique ports across all concurrent containers
• Eliminate as u16 truncation bug and TOCTOU race conditions when multiple sandboxes start simultaneously under --network=host
• Port range: 10,000–60,000 with atomic wrap-around

Tool Server Robustness (docker_sandbox.rs, tool_server.rs)

• Add HTTPServer.allow_reuse_address = True in the embedded Python server to reduce Address already in use errors
• Wrap HTTPServer() creation in try/except to catch and log OSError on port bind failure
• Increase health check from 6×500ms (3s) to 12×500ms (6s) to handle slow container startup under load
• Add full retry loop (up to 2 attempts) that kills stale processes and re-writes the server script
• Verify script file size after writing to detect truncated stdin pipe transfers
• Change start_tool_server() to return bool indicating success, tracked via tool_server_ok field

Shell-Based Tool Fallback (test_generator.rs)

• Add shell_fallback() function implementing all 5 tools (read_file, list_dir, grep_files, search_files, apply_patch) via direct shell commands
• When tool server is unavailable or returns connection errors, transparently fall back to shell execution
• Extract parse_tool_response() into a standalone function for cleaner code organization

Error Handling Improvements (docker_sandbox.rs)

• Upgrade git install failed from WARN-and-continue to anyhow::bail! — a sandbox without git is unusable
• Upgrade checkout failed from WARN-and-continue to anyhow::bail! — running tests against the wrong commit produces invalid results
• Both failures now properly destroy the container before returning the error

Tests

• Add test_allocate_port_returns_valid_range and test_allocate_port_sequential_unique unit tests for the new port allocator