Read an empty Bot PORT as unset, so NaN never reaches Bun.serve

[Bartok9]

What this changes

PORT= on agent-bot / agent-langgraph used to parse as NaN and Bun.serve bound an ephemeral port while compose still published 4200/4201. Empty now means the shipped default; a non-digit value refuses to start. Same trap as supervisor #343.

Where it runs

• New state that outlives a request? None.
• What happens on the second replica? Each process reads its own PORT at boot. No shared state.
• Anything serialised? No.
• Anything fanned out to a browser? No.
• New listener, port, or schedule? No. Existing listen ports only, parsed the same way as the supervisor.

Boundary and audit

• Every acting call still goes through the gateway: resolve, decide, audit, then act.
• New refusals and new failures each write a row. Boot refusal is process exit before serve; no new acting path.
• Nothing new is trusted from the client that the server can resolve itself.

Changelog

• A line in CHANGELOG.md under Unreleased.

Proof

Shared listenPort tests: empty/whitespace → fallback; digits in range accepted; 42o0 / 0 / 65536 refused.

[davidmckayv]

Deep-reviewed against live code (correctness, governance, no vendor/secret/scale issues). Composed build+tests green. CHANGELOG/format rebase on CI-validated substance.