Bind the mux listeners exclusively so node cluster cannot share them

[CedricConday]

srt is built around one process owning one proxy: the mux backend binds a pid-scoped unix socket and each process mints its own proxyAuthToken, with the code noting the token is set "only when this process owns the proxy".

The mux front-end contradicted that. It bound with a plain server.listen(port, '127.0.0.1'), and under Node's cluster module the primary intercepts listen(), shares one handle across every worker and round robins incoming connections. A sandboxed command spawned by worker A carries A's token in its environment, lands on worker B's proxy, and is answered with 407 Proxy Authentication Required. The failure rate scales as (N-1)/N for N workers, which is how PM2's cluster exec_mode produces intermittent 407s that a retry usually clears.

Both loopback listeners now go through loopbackListenOptions(), which sets exclusive, so each worker binds its own port and a child always reaches the proxy whose token it holds.

The test drives a real cluster rather than asserting on the shape of the call: three workers report one shared port with a plain listen and three distinct ports with an exclusive one. typecheck and lint:check are clean.

Closes #458