host: add --port flag for inbound listen-port allowlist

[danbugs]

Summary

• Adds ListenPorts type — an allowlist of ports the guest may bind to for inbound connections
• Adds --port PORT CLI flag (repeatable) to hyperlight-unikraft and pyhl (both setup and run)
• net_bind is now gated: without --port, bind is rejected with EACCES; with --port 8080, only port 8080 is allowed
• --port implies --net, so --port 8080 alone enables networking + inbound on that port
• --net alone enables outbound-only (no bind/listen)
• Updates networking-py Justfile: run-echo now uses --port 8080

This makes inbound networking opt-in and explicit, matching the existing pattern where --net/--net-allow/--net-block gate outbound.

Test plan

• cargo test — 35 unit tests pass (4 new: ListenPorts permit/deny, net_bind with/without allowlist)
• --port 8080 + echo_server.py — bind succeeds, echo works end-to-end
• --net alone + echo_server.py — bind fails with OSError
• --port 8080 + inline bind to 9090 — 8080 succeeds, 9090 fails
• --port without --net — networking is implicitly enabled

[github-actions]

Linux Benchmarks

Details

Benchmark suite	Current: 1c303ff	Previous: 0eb9887	Ratio
hello_world (median)	20 ms	20 ms	1
pandas (median)	110 ms	100 ms	1.10
density (per VM)	7 MB	7 MB	1
snapshot (disk)	385 MiB	385 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Windows Benchmarks

Details

Benchmark suite	Current: 1c303ff	Previous: 0eb9887	Ratio
hello_world (median)	276 ms	271 ms	1.02
pandas (median)	884 ms	850 ms	1.04
density (per VM)	6 MB	6 MB	1
snapshot (disk)	393 MiB	393 MiB	1

This comment was automatically generated by workflow using github-action-benchmark.