fix(proxy): keep one proxy per state directory

Problem

A state directory tracks one proxy through proxy.pid and proxy.port, but proxy start -p <port> only probed the requested port. With a proxy on A, proxy start -p B started a second proxy, overwrote both files, and left A running with nothing tracking it. proxy stop -p A then killed the PID in proxy.pid, which was B (#521).

Changes

• proxy start exits 1 when the state directory tracks a live proxy on another port. The error gives the command to move that proxy, and points to PORTLESS_STATE_DIR for running a second one.
• proxy stop -p A ignores proxy.pid when it belongs to a live proxy on another port. It stops only the proxy listening on A and leaves the state files alone. When the tracked proxy is dead, stop still clears its stale files as before.
• A stopping proxy clears the state files only when proxy.pid names it. Stopping an untracked proxy left behind by an older version no longer wipes the tracked proxy's state.
• A tracked proxy counts as live only when its PID is alive and its port answers, so a stale proxy.port cannot block a start.

The README, skill, proxy --help, and the proxy_start MCP tool now state that a state directory tracks one proxy.

Closes #521

Proof

macOS, fresh PORTLESS_STATE_DIR, the reproduction from the issue:

# main
$ portless proxy start -p 13560 --no-tls
HTTP proxy started on port 13560
$ portless proxy start -p 13561 --no-tls
HTTP proxy started on port 13561
$ portless proxy stop -p 13560
Proxy stopped.
# still listening: 127.0.0.1:13560 [::1]:13560

# this branch
$ portless proxy start -p 13560 --no-tls
HTTP proxy started on port 13560
$ portless proxy start -p 13561 --no-tls
Error: A proxy is already running on port 13560.
To move it, stop it first:
  portless proxy stop -p 13560 && portless proxy start -p 13561
To run a second proxy, give it its own PORTLESS_STATE_DIR.
exit=1
$ portless proxy stop -p 13560
Proxy stopped.
# still listening: (nothing)

Tests

New lifecycle tests in cli.test.ts:

• A second proxy start on another port exits 1 and leaves the first proxy tracked.
• With the state files pointing at another live proxy (the state an older version leaves), proxy stop -p <port> stops only that port, and the stopped proxy's exit cleanup leaves the tracked proxy's proxy.pid and proxy.port in place.
• With a dead proxy recorded on another port, proxy stop still removes the stale files.

The first two fail on main. Two existing tests, certs.test.ts (#429) and the broken security binary test (#228), fail the same way on main and on this branch on my machine.