fix(demos): wait for the gateway to bind instead of sleeping

[imran-siddique]

What

Demos 1-5 and the web console started their subprocesses and then slept a fixed 1-2 seconds before the first call. cMCP Runtime 0.3.0 does attestation and audit setup before it binds :8443, so on a cold start every cMCP demo failed with ConnectionRefusedError / URLError on its first tool call. Demo 3 then failed too, since it reads demo 1's claim.

They now poll the port until it accepts, with a 60s ceiling and an error that points at the *.log files.

Also corrects demo-05's module docstring, which still said "Demo 4: context-aware enforcement".

Verified locally

python demo.py --no-pause — all 9 demos pass, exit 0:

• demo 1: write/read allowed, list_dir 403 POLICY_DENY, signed claim written
• demo 2: v2 write denied, policy_bundle.hash FAIL against the pinned v1 hash and PASS against v2
• demo 3: offline verify partially_verified, all crypto checks pass
• demo 4: write_file allowed in invoice-run, 403 in chat-freeform, read allowed in both
• demo 5: BAA guardrail denies the non-covered tool
• demos 6-9: unchanged (WCM 0.23.0)

Web console: all three obligors run through the real financial-services example; the €750k write is blocked citing EBA/GL/2020/06 under the approved bundle, allowed under the tampered bundle, and that record then fails policy_bundle.hash against the pinned approved hash.

🤖 Generated with Claude Code