fix(envd): port scanner ignores net.Connections error and drops active forwarded ports

Problem

Inside envd (packages/envd/internal/port/scan.go), the background port scanner loop invokes net.Connections("tcp") and silently discards the returned error using _.

When reading /proc/net/tcp or /proc/net/tcp6 fails (e.g. transient kernel resource pressure or procfs read errors), processes evaluates to nil. Passing an empty/nil connection list to subscribers causes Forwarder to assume zero local TCP ports are listening. As a result, Forwarder marks all active forwarded ports as DELETE and forcibly terminates all background socat forwarding processes, dropping user process reachability without logging any diagnostic error.

Additionally, packages/envd/internal/port has no unit tests.

// Transient failure reading /proc/net/tcp inside guest:
net.Connections("tcp") -> returns (nil, err)
// Error ignored with _:
processes, _ := net.Connections("tcp")
// Forwarder receives nil processes -> kills active socat instances!

Root Cause

In packages/envd/internal/port/scan.go:

Reproduction Steps

1. Start envd with port scanning active.
2. Simulate a procfs or system error where net.Connections("tcp") returns (nil, err).
3. Observe ScanAndBroadcast broadcasting nil processes to subscribers.
4. Observe Forwarder killing all active socat port-forwarding processes on guest ports.

// Current implementation in packages/envd/internal/port/scan.go
func (s *Scanner) ScanAndBroadcast() {
    ticker := time.NewTicker(s.period)
    defer ticker.Stop()

    for {
        processes, _ := net.Connections("tcp") // Silent error discard!
        for _, sub := range s.subs.Items() {
            sub.Signal(processes)
        }
        select {
        case <-s.scanExit:
            return
        case <-ticker.C:
        }
    }
}

Technical Context

• Files affected: packages/envd/internal/port/scan.go, packages/envd/main.go, packages/envd/pkg/version.go
• Subsystem: Envd (In-VM Agent)
• Impact: Medium

Proposed Changes

Start in packages/envd/internal/port/scan.go and trace Scanner construction from packages/envd/main.go. Add coverage in packages/envd/internal/port/scan_test.go for scanner lifecycle, filtering, subscriber behavior, and connection errors; done means errors are logged without broadcasting invalid results and active forwards are retained. Update packages/envd/pkg/version.go to 0.6.12 as specified.