fix(translator): honour a BYO harness's configured PORT so the card and runtime agree

[wangzhengzhuo05]

What

The byo harness compiler advertised the agent card at http://127.0.0.1:80 while injecting no PORT, so a BYO image built with go/adk/pkg/app listened on its 8080 default, reported READY, and then failed every invoke.

The port is now taken from the harness's own configuration: whatever PORT the harness sets in spec.env is what both the runtime receives and the card advertises. PORT=80 is only injected when the harness configures no usable port.

Why

go/core/internal/translator/byo/compiler.go built the card with a hard-coded http://127.0.0.1:80, but its environment was only compiled.Environment plus adkconfig.HarnessEnvironment(harness). go/adk/pkg/app resolves the listen port as cfg.Port -> PORT env -> default 8080, so the card and the runtime disagreed. Readiness is probed on :8081 independently of PORT, so nothing surfaced the mismatch and the instance stayed READY while unreachable.

BYO is an opaque harness, so the compiler must not force a port it cannot know (review feedback on this PR). At the same time the card and the runtime must not be able to disagree, so the advertised port is derived from the environment that is actually rendered.

How

• Build the environment as adkconfig.DedupeEnv(compiled.Environment + HarnessEnvironment(harness)).
• configuredPort reads the last PORT entry in that environment (the same last-wins semantics DedupeEnv uses). A value in 1..65535 is the harness's port, and nothing is injected.
• Otherwise the default 80 is appended, matching the built-in kagent compiler for an unconfigured BYO harness.
• agentTemplateCard now takes the resolved port and builds http://127.0.0.1:<port>.
• Environment is resolved before BuildProvenance so the provenance hashes the same environment that ships.

No API or CRD change.

Tests

• TestCompilePortResolution covers: no PORT -> exactly one PORT=80 and card http://127.0.0.1:80; spec.env PORT=8080 -> exactly one PORT=8080 and card http://127.0.0.1:8080; PORT=banana -> falls back to exactly one PORT=80 and card http://127.0.0.1:80.
• TestCompileOpaqueImage unchanged in intent.
• cd go && go test ./core/internal/translator/byo/... passes; cd go && go build ./... passes; gofmt -l clean.
• Mutation check: pinning configuredPort to always report "not configured" makes the PORT=8080 case fail, so the regression test guards the behaviour rather than the implementation.

This change was implemented with AI assistance (OpenCode + muse-spark 1.3) and reviewed and verified locally; I understand it and take responsibility for it.

Fixes #2758

Mistake

[EItanya]

I approved this, but actually I realized that I'm not sure it makes sense. BYO is meant to be opaque harness, so I'm not sure we should auto inject that variable, maybe the user can do it via config?

[wangzhengzhuo05]

Thanks for the review — agreed, and reworked.

BYO is opaque, so the harness's own configuration now wins:

• a PORT set in spec.env is honoured verbatim — nothing is injected, and the card advertises http://127.0.0.1:<that port>, so the card and the runtime cannot disagree;
• PORT=80 is only injected when the harness configures no usable port, which keeps the unconfigured BYO case from byo harness injects no PORT but advertises the agent on :80, so a BYO image built with go/adk/pkg/app is READY and unreachable #2758 working out of the box and matches what the built-in kagent compiler already does.

Covered by TestCompilePortResolution:

• no PORT -> injected PORT=80, card :80
• PORT=8080 in spec.env -> single PORT=8080, card :8080 (the case you flagged)
• PORT=banana -> falls back to PORT=80, card :80

go test ./core/internal/translator/byo/... and go build ./... are green, and the PORT=8080 case fails if the resolution is stubbed out. No API or CRD change.