fix(cli): resolve -p 0 (auto-assign host port) to a real free port

`docker run -p 0:80` (or an auto-assign publish) picks a free host port; a3s-box
stored host port 0, which the shim/passt filters skip (host_port != 0) so it was
never forwarded and `port` printed literal 0. normalize_port_maps now resolves a
0 host port to a concrete free ephemeral port (claimed briefly via a
TcpListener), so it is forwarded and `port` shows the real number. Verified on
Linux: `-p 0:80` -> `80/tcp -> 0.0.0.0:36517`.

Author: Roy Lin

src/cli/src/commands/common.rs

@@ -330,7 +330,32 @@ pub(crate) fn effective_stop_signal(
 
 /// Validate and normalize published port mappings to the runtime format.
 pub(crate) fn normalize_port_maps(entries: &[String]) -> Result<Vec<String>, String> {
-    a3s_box_core::normalize_port_maps(entries)
+    a3s_box_core::normalize_port_maps(entries)?
+        .into_iter()
+        .map(resolve_auto_host_port)
+        .collect()
+}
+
+/// Resolve an auto-assign host port (host part `0`, e.g. `-p 0:80`) to a
+/// concrete free ephemeral port by briefly claiming one with a TcpListener, so
+/// the shim/passt actually forward it and `port` prints the real number
+/// (matching Docker). A non-zero host port is returned unchanged.
+fn resolve_auto_host_port(entry: String) -> Result<String, String> {
+    let Some((host, guest)) = entry.split_once(':') else {
+        return Ok(entry);
+    };
+    if host != "0" {
+        return Ok(entry);
+    }
+    let listener = std::net::TcpListener::bind("0.0.0.0:0")
+        .map_err(|e| format!("failed to allocate a host port for '{entry}': {e}"))?;
+    let port = listener
+        .local_addr()
+        .map_err(|e| format!("failed to read allocated host port: {e}"))?
+        .port();
+    // Release it so the box can bind the port (small TOCTOU window, as Docker has).
+    drop(listener);
+    Ok(format!("{port}:{guest}"))
 }
 
 /// Reject runtime options that a3s-box cannot enforce yet.
@@ -510,6 +535,21 @@ pub(crate) fn build_resource_limits(
 mod tests {
     use super::*;
 
+    #[test]
+    fn test_resolve_auto_host_port() {
+        // A non-zero host port is unchanged.
+        assert_eq!(
+            resolve_auto_host_port("8080:80".to_string()).unwrap(),
+            "8080:80"
+        );
+        // `0:80` resolves to a concrete non-zero host port, keeping the guest port.
+        let resolved = resolve_auto_host_port("0:80".to_string()).unwrap();
+        let (host, guest) = resolved.split_once(':').unwrap();
+        assert_eq!(guest, "80");
+        assert_ne!(host, "0");
+        assert!(host.parse::<u16>().unwrap() > 0);
+    }
+
     // --- parse_env_vars tests ---
 
     #[test]