feat(overlay): 覆盖网络线序①–⑮ 代码与测试产物入库

覆盖网络线累积产物（此前只在工作区、未入版本库）：
- 新增 relay 子系统 src/net/relay/**（wire/duplex/server/client/dialer/switcher/directory/identity/keys/placement/network/addr-override/main/index）
- 新增 src/worker/relay-tunnel.ts、src/web/routes/overlay.ts
- 新增观测/演练脚本 overlay-probe、overlay-failover-drill、overlay-keyring、overlay-holepunch、overlay-jitter、overlay-wan、overlay-relaykey-add、relay-mem-calibrate
- 新增测试 12 个（relay / relay-failover / remote-spawner / instance-port / overlay-{network,auth,bootstrap,identity} / remote-user-fs 等）

验收基线：npm test = 162 pass / 0 fail / 1 skip；--scene all = 12 PASS / 0 SKIP / 0 FAIL；overlay-probe = 12/12

src/supervisor/orchestrator.ts

@@ -37,7 +37,7 @@ import {
   type CrashPolicyConfig,
 } from './crash-policy.js'
 import { createPortGuard, type PortGuard } from './firewall.js'
-import { findFreePort, scrubEnv } from './spawn.js'
+import { findInstancePort, scrubEnv } from './spawn.js'
 import {
   AlreadyRunningError,
   CrashBreakerOpenError,
@@ -592,7 +592,10 @@ export class LocalSpawner implements Spawner {
 
   private async spawnInstance(userId: string, role: InstanceRole, folder: string, patch?: string): Promise<Instance> {
     const isMain = role === 'main'
-    const port = isMain ? await findFreePort() : undefined
+    // 覆盖网络 S3：端口来自**本机专属区间**（未配 env ⇒ 退回旧的 `listen(0)`）。
+    // 为什么不能用 `listen(0)`：跨机实例的隧道落点全挤在 Manager 的 `127.0.0.1`，
+    // 两台 worker 各自随机取端口就会撞号，而 `-R` 失败是**静默**的 ⇒ 会拨到别人的实例。
+    const port = isMain ? await findInstancePort(this.config.instancePortBase, this.config.instancePortSpan) : undefined
     const instance: Instance = {
       id: randomUUID(),
       userId,