`make test` is red locally: testserver hardcodes ports 8443/8444

make test fails on main for two packages, every run, and it has nothing to do with the code under test.

pkg/testserver/server.go hardcodes localhost:8443 for the coordinator and localhost:8444 for the runner. Three packages call testserver.TestServer(t) — pkg/addon/mysql, pkg/addon/postgresql, and pkg/addon/rabbitmq — and hack/test.sh runs go test ./... with no -p 1, so all three race inside one container. First one wins; the others die with listen udp 127.0.0.1:8443: bind: address already in use. On a clean main checkout that's postgresql and rabbitmq failing, reliably rather than flakily.

CI never sees it. The groups in hack/test-groups.json put those packages on separate runners (mysql in 0, rabbitmq in 2, postgresql in 3), so each gets its own machine and its own 8443. It only bites locally, where the whole suite shares one container. There's a comment in hack/test.sh asserting that tests "use unique containerd namespaces and dynamic ports, so they should be safe to run in parallel" — true everywhere except here.

The codebase is already set up for the real fix: bind localhost:0 and let the OS assign. rpc.State.ListenAddr() returns transport.Conn.LocalAddr(), the actual bound socket, and Coordinator.ListenAddress() surfaces it, so TestServer can report back the address it really got. No port probing, no TOCTOU window.

Roughly:

• TestServer binds :0 for both coordinator and runner, and returns the coordinator's real address.
• The three tests swap rs.Connect("localhost:8443", ...) for that returned address — one line each.
• TestServerConfig carries its own hardcoded 8443 and has zero callers; delete it.

One sequencing detail: the runner needs the coordinator's address, so that read has to happen after the coordinator binds. RunnerConfig(listenAddress) already takes it as a parameter, so the plumbing is there.

Found while flipping the saga default (MIR-953), where the noise made it genuinely hard to tell which failures were mine.