fix(service_manager): rip out dead port parameter

PR #30136 review caught: `_allocate_gateway_port()` in profiles.py
computed a SHA-256-derived port that was threaded through
`register_profile_gateway(profile, port=N)` →
`_render_run_script(profile, port, extra_env)` → and then **ignored**.
The rendered run script picked the bind port from the profile's
config.yaml (`[gateway] port = …`), never from the allocator. So
the entire allocator + parameter chain was dead code.

Remove:

* `hermes_cli.profiles._allocate_gateway_port` (deterministic
  SHA-256 → [9200, 9800) — never used).
* `port` kwarg from `ServiceManager.register_profile_gateway`
  (Protocol + Mixin + S6 implementation).
* `port` positional arg from `_render_run_script(profile, port,
  extra_env)` — now `_render_run_script(profile, extra_env)`.
* The pass-through call in `profiles._maybe_register_gateway_service`.

config.yaml is now the single source of truth for gateway port
selection — matches reality and reduces the API surface. Three
explanatory comments in service_manager.py / profiles.py document
the retirement so future readers don't reach for the allocator and
find a ghost.

Tests: drop the three `_allocate_gateway_port` tests; update
fakes' signatures throughout test_service_manager.py and
test_profiles_s6_hooks.py to match the new no-port API.

hermes_cli/container_boot.py

@@ -198,7 +198,7 @@ def _register_service(scandir: Path, profile: str, *, start: bool) -> None:
     # env can set it via the profile's config.yaml (which the gateway
     # itself loads).
     run = service_dir / "run"
-    run.write_text(S6ServiceManager._render_run_script(profile, port=0, extra_env={}))
+    run.write_text(S6ServiceManager._render_run_script(profile, extra_env={}))
     run.chmod(0o755)
 
     # Persistent log rotation (OQ8-C).

hermes_cli/profiles.py

@@ -977,26 +977,6 @@ def delete_profile(name: str, yes: bool = False) -> Path:
     return profile_dir
 
 
-def _allocate_gateway_port(profile_name: str) -> int:
-    """Deterministic port allocation for a profile's s6-supervised gateway.
-
-    Phase 4 of the s6-overlay supervision plan. Ports live in
-    [9200, 9800) — a 600-port window starting just past the dashboard
-    default (9119). Allocation is deterministic via SHA-256 of the
-    profile name so the same profile always gets the same port across
-    container restarts.
-
-    Collision probability is small (~1/600 per pair of profiles); if
-    it happens the gateway will fail to bind with a clear OSError and
-    the caller can set ``HERMES_GATEWAY_PORT`` to override. The
-    Phase 4 plan accepts this rather than carrying explicit allocator
-    state in the persistent volume.
-    """
-    import hashlib
-    h = int(hashlib.sha256(profile_name.encode()).hexdigest()[:8], 16)
-    return 9200 + (h % 600)
-
-
 def _maybe_register_gateway_service(profile_name: str) -> None:
     """Register a profile's gateway with s6 inside the container.
 
@@ -1004,11 +984,16 @@ def _maybe_register_gateway_service(profile_name: str) -> None:
     ``NotImplementedError`` on ``register_profile_gateway`` and the
     existing per-profile unit-generation paths handle lifecycle.
 
-    Best-effort: any error (no backend detected, port collision, s6
-    not yet ready, etc.) is logged and swallowed so profile creation
-    doesn't fail because the s6 supervision tree is in a weird state.
-    The user can re-register manually later via the gateway start
-    command, which goes through the same dispatch path.
+    Best-effort: any error (no backend detected, s6 not yet ready,
+    etc.) is logged and swallowed so profile creation doesn't fail
+    because the s6 supervision tree is in a weird state. The user
+    can re-register manually later via the gateway start command,
+    which goes through the same dispatch path.
+
+    Port selection is governed by the profile's ``config.yaml``
+    (``[gateway] port = …``) — there is no Python-side allocator
+    (PR #30136 review item I5 retired the SHA-256-derived range
+    [9200, 9800) because it was dead code through the entire stack).
     """
     try:
         from hermes_cli.service_manager import get_service_manager
@@ -1017,9 +1002,8 @@ def _maybe_register_gateway_service(profile_name: str) -> None:
         return  # no backend on this host — nothing to do
     if not mgr.supports_runtime_registration():
         return  # host backend; no-op
-    port = _allocate_gateway_port(profile_name)
     try:
-        mgr.register_profile_gateway(profile_name, port=port)
+        mgr.register_profile_gateway(profile_name)
     except ValueError:
         # Already registered (e.g. the container-boot reconciler ran
         # first and brought up a stale slot). That's fine.

hermes_cli/service_manager.py

@@ -76,7 +76,6 @@ class ServiceManager(Protocol):
         self,
         profile: str,
         *,
-        port: int,
         extra_env: dict[str, str] | None = None,
     ) -> None: ...
     def unregister_profile_gateway(self, profile: str) -> None: ...
@@ -175,7 +174,6 @@ class _RegistrationUnsupportedMixin:
         self,
         profile: str,
         *,
-        port: int,
         extra_env: dict[str, str] | None = None,
     ) -> None:
         raise NotImplementedError(
@@ -421,7 +419,6 @@ class S6ServiceManager:
     @staticmethod
     def _render_run_script(
         profile: str,
-        port: int,
         extra_env: dict[str, str],
     ) -> str:
         """Generate the run script for a profile-gateway s6 service.
@@ -446,16 +443,15 @@ class S6ServiceManager:
         would instead look up ``$HERMES_HOME/profiles/default/`` — a
         completely different (and almost always nonexistent) profile.
 
-        Note: the ``port`` parameter is accepted for API parity with
-        :meth:`register_profile_gateway` but is currently ignored — the
-        gateway picks its bind port from the profile's config.yaml
-        (``[gateway] port = ...``). A future signature change may carry
-        it through as an ``HERMES_GATEWAY_PORT`` env var; until then,
-        the in-config value wins and the constructor's ``port`` arg
-        is essentially documentation for "what port the profile would
-        use if we wired it through". See Phase 4 Task 4.1 for the
-        deterministic allocator and the SHA-256-derived range
-        [9200, 9800).
+        Port selection: the gateway picks its bind port from the
+        profile's ``config.yaml`` (``[gateway] port = ...``) — that
+        is the single source of truth. Previously this method took a
+        ``port`` parameter that was passed in but never substituted
+        into the rendered script (it was carried in for "API parity"
+        with a deterministic SHA-256 allocator in
+        ``hermes_cli.profiles._allocate_gateway_port``). PR #30136
+        review item I5 retired both the allocator and the parameter
+        because they were dead code through the entire stack.
         """
         import shlex
         lines = [
@@ -592,7 +588,6 @@ class S6ServiceManager:
         self,
         profile: str,
         *,
-        port: int,
         extra_env: dict[str, str] | None = None,
     ) -> None:
         """Create the s6 service directory for a profile gateway.
@@ -629,7 +624,7 @@ class S6ServiceManager:
         try:
             (tmp_dir / "type").write_text("longrun\n")
 
-            run_script = self._render_run_script(profile, port, extra_env or {})
+            run_script = self._render_run_script(profile, extra_env or {})
             run_path = tmp_dir / "run"
             run_path.write_text(run_script)
             run_path.chmod(0o755)