docs: add port-allocations.md — choosing conflict-unlikely service ports

Guidance for picking a listening port that won't collide on a shared-host
fleet: use the registered range (1024-49151), avoid the crowded alt-HTTP
cluster (3000/5000/8000/8080/8081/8443/9000...) and never the ephemeral range
(49152+, kernel source ports), derive from the service name into a sparse band,
and — the actual anti-collision mechanism — record every allocation in a fleet
registry. Seeds the registry with the services documented across this repo
(pg, neuron, bench, gongfoo controller/agent, cortex) plus newsfeed-api.

Motivated by newsfeed-api having been put on 8081 (the alt-HTTP port). Linked
from generic.md §9.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fKZzDpvjiJ9eYbPGgJvUP

generic.md

@@ -390,6 +390,8 @@ If the service must run as root or with extra capabilities, document the reason
 
 All hosts run `firewalld`. Every service that listens on a port must ship a **named firewalld service definition** rather than opening bare ports in a zone. The service name matches the systemd unit name (minus `.service`).
 
+**Choosing the port itself** — an uncommon number in the registered range, never a crowded alt-HTTP port (`8080`/`8081`/…) or the ephemeral range, recorded in a fleet registry — is covered in **`port-allocations.md`**. The number there must match this XML, the service's bind config, and the SELinux `semanage port` label (§10).
+
 ### Why named services
 Named services are self-documenting (`firewall-cmd --list-services` tells you what's actually running), removable atomically on app decommission, and survive zone reassignment without reconfiguration.