feat(openshell): add safe port forwarding and service-gateway integration #579

Outcome

Add OpenShell port behavior that preserves acq's local-forwarding semantics without implicitly creating public services.

Scope

• Map acq ports NAME --publish HOST:GUEST to OpenShell's local forwarding primitive.
• Keep gateway HTTP/WebSocket service exposure closed by default.
• Do not translate neutral published ports into public service exposure automatically.
• If a kit-declared companion gateway becomes necessary, consume the merged patterns serviceGateways vocabulary rather than creating a backend-specific kit representation.
• Document the exposure boundary and capability behavior.

Verification

Add offline port-routing tests and a live local-forward create/list/reachability/teardown test. If serviceGateways is used, include its patterns-side validation and adapter coverage.