fix(server): bind gateway listeners before sandbox resume

[elezar]

Summary

Bind all resolved gateway listener sockets before resuming persisted sandboxes. This prevents a startup bind failure from occurring after sandbox compute has already been resumed, while preserving the invariant that resume completes before compute watchers start.

Related Issue

No linked issue.

Changes

• Extract gateway listener address resolution and socket binding into a focused helper
• Bind the primary and driver-provided gateway listeners before persisted sandbox resume
• Keep watcher startup after resume so watchers observe post-resume state
• Add a regression test proving a failed extra-listener bind prevents the resume path from being reached

Testing

• mise run pre-commit passes
• Unit tests added/updated (cargo test -p openshell-server gateway_listener)
• E2E tests added/updated (not applicable; startup ordering is covered by the regression unit test)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; no stable documented interface changed)