server: refuse unsigned releases and polluted reserved addresses

Self-update now verifies SHA256SUMS.sig (ed25519, relsign package) against
a public key baked into the binary; the private key exists only in the CI
secret store, so a compromised release host can withhold updates but not
inject one. CI signs on every server-v* tag and hard-fails without the
secret. Operators with their own pipeline override the key via
ECHOLOT_SELF_UPDATE_PUBKEY (mint a pair with release-sign -gen).

Startup also now proves 80/443 are actually free on the reserved
measurement addresses by asking the OS (throwaway bind), not the config -
CheckReserved could never see a stray process, and the adb-beacon receiver
on 0.0.0.0:443 was exactly that.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/internal/selftest/reserved_windows.go

@@ -0,0 +1,20 @@
+// SPDX-FileCopyrightText: 2026 Echolot contributors
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+//go:build windows
+
+package selftest
+
+import (
+	"errors"
+	"syscall"
+)
+
+// Winsock reports a taken port as WSAEADDRINUSE (10048), which syscall.EADDRINUSE does not match
+// on Windows — and the stdlib syscall package does not export the WSA constant. The server
+// deploys on Linux; this exists so the tests tell the truth on a Windows development machine too.
+const wsaeaddrinuse = syscall.Errno(10048)
+
+func isAddrInUse(err error) bool {
+	return errors.Is(err, wsaeaddrinuse) || errors.Is(err, syscall.EADDRINUSE)
+}