fix(demos): refuse to run on a busy port, and cover demos 4-9 in CI

[imran-siddique]

The bug

_wait_for_port() returns as soon as anything answers on the port. A cMCP gateway left running by an earlier demo satisfies it instantly, so every call in the next demo goes to that gateway and is decided by its policy bundle. The demo then prints allow/deny lines that are simply wrong, with no error anywhere.

I hit this while auditing. demo-05 reported:

[1/3] write_file  [clinical, baa_covered=true]
      ERROR 403: Request denied by policy [POLICY_DENY]

That is wrong: the guardrail forbids baa_covered == false. The cause was demo-04's gateway still holding :8443. On a clean port demo-05 is correct:

[1/3] write_file  [clinical, baa_covered=true]     ALLOWED
[2/3] read_file   [clinical, baa_covered=true]     ALLOWED
[3/3] list_dir    [external-analytics, false]      HTTP 403 POLICY_DENY

Separately, there was a real cmcp.exe on my machine holding :8443 since 2026-08-04, from a demo session two days earlier. Anyone demoing live would have hit this.

Changes

_assert_port_free()	Checks :9001 and :8443 before anything starts, in all four gateway demos. Aborts with an actionable message rather than borrowing another demo's gateway.
_wait_for_port_release()	In teardown, so a demo cannot hand the next one a port that is still closing.
run.sh for 1, 2, 4, 5	Now exec run.py. They had diverged badly: still sleep 2 (the race #34 fixed in run.py), no port checks, and demo-02's ran cmcp verify while the servers were still up. Verified run.py covers all six of demo-02's steps.
CI: demos 4-9	Only 1-3 were covered. The other six were never exercised.
CI: -r requirements.txt	It already pinned weight-custody-manifest>=0.23.0, which demos 6-9 import. Installing cmcp-runtime alone would have made the new steps fail on import wcm.

Verified

Precheck fires. With :8443 held, demo-04 exits 1:

Port 9001 is already in use, so the MCP filesystem server cannot start and this
demo would be scored against whatever is already listening. Stop it first ...

It also caught a stray MCP server on :9001 that I did not know was running, which is the behaviour working as intended.

Demos 1-5 run sequentially in one shell and all pass, which is the case that previously produced wrong verdicts, and both ports are free afterwards. Demos 6-9 pass. The run.sh wrappers for 03 and 04 pass.

Deliberately not done

No assertion that the claim's policy.bundle_hash matches the demo's own bundle. It would be a useful backstop, but cmcp does not log its bundle hash at startup, so there is nothing to compare against without reimplementing the hashing recipe, and guessing that risks false failures. The port precheck removes the situation that made it necessary.

Found while auditing every example and sample across the agentrust-io repos.