fix(fifa17): complete kit stats, restore red squad tests, unrot prod gate

Four defects found by running the suites and the staging lifecycle end to end
after the kit milestone.

1. club-stats kits were half-implemented. The global `kits` counter was real
   but `kitsHome`/`kitsAway` and every per-team `kits` bucket stayed hardcoded
   0, so the same screen reported two owned kits and zero home/away kits.
   `kits` is a total with a family split, exactly like players/playersGold and
   staff/staffManager. The split key is `fcc_kitcards.assetid`: 14 is the home
   family and 15 the away family, verified across all 1482 rows of the kit
   table (assetid 14 covers exactly the 63xxxxx carddbids, 828 rows; assetid 15
   exactly the 64xxxxx ones, 654 rows; no exceptions either way).
   ClubStatInput now carries `asset_id`, and a kit buckets onto the team that
   wears it -- including a team the club owns no player from, the normal case
   for a kit won from a pack. The host reads both from the catalog through new
   NON-MINTING accessors: `resolve`/`resolve_kit` allocate a wire id, which a
   read-only stats query must never do as a side effect.

2. host_test.rs had 10 tests red since the squad-manager work (25f4ad1 /
   d37a9d5); 56bd9dd updated the squad_projection integration test and stopped
   there. `put_body` hardcoded the captured manager ref 100000427 into EVERY
   save, including tests with no manager fixture, so each one was refused with
   `unresolved_wire_ids` -- the tests were reporting a real invariant against a
   fixture that could not satisfy it. The manager is now an explicit
   `Option<i64>` per test, and FakeCore models Core's manager persistence
   instead of inheriting the "not implemented" default that 502'd every save.
   Added the coverage whose absence let this rot: a manager assignment
   round-trips as a Core owned id, a later save without one CLEARS it, and an
   unowned manager ref refuses the whole save with nothing committed.

3. `club_route_maps_query_and_shapes_core_items` pinned `offset`/`limit`
   forwarding to Core, which the kit commit deliberately replaced with
   host-side pagination. It only ever passed because FakeCore ignored the
   window -- against a real Core, `start=10` over a one-item club was always an
   empty page. Retargeted to the real contract (Core gets semantic filters and
   NO window) plus a new test that the window is applied locally after
   filtering, which the old fake made vacuous.

4. The staging lifecycle scripts identified production by hardcoded pids, so a
   correct teardown FATAL'd: production moved into containers and pids
   3631953/3374264 died with a container restart days ago. A pinned pid rots
   into the worst of both worlds -- a kill-refusal gate that no longer names
   any real production process, and a liveness gate that fails a healthy
   teardown. New shared `scripts/openfut_production.py` resolves production
   pids AND published ports from the container runtime at the moment they are
   needed, refuses to signal anything it cannot see, and proves production is
   the same processes serving the same ports before and after. Both lifecycle
   scripts use it, which also closed a real gap: port 8085 is published by
   openfut-fut-backend but was missing from the up script's forbidden list, so
   staging could have bound a production port.

Also fixes the economy differential, red because `complete_match` unlocks
achievements in the same transaction that pays the match reward -- a deliberate
Core feature the Python oracle has no counterpart for. `rust WIN +400` asserted
that progression did not exist; it now asserts the delta is the 400 match reward
plus exactly the achievements the match unlocked, read from Core's own report.

scripts/sold-staging-up.py

@@ -60,16 +60,24 @@ import subprocess
 import sys
 import time
 
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from openfut_production import (  # noqa: E402
+    PROD_PORTS,
+    ProductionError,
+    ProductionState,
+    listening_ports,
+    production_state,
+)
+
 # --- fixed facts -------------------------------------------------------------------
 
 REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
 
-# Production. Never bind, never connect, never open.
-FORBIDDEN_PORTS = frozenset(
-    {8099, 8199, 18080, 8443, 42127, 42130, 42131, 4216, 8080, 8081, 8094}
-)
+# Production. Never bind, never connect, never open. Production's pids are NOT
+# listed here: they live in containers and change on every restart, so they are
+# resolved from the container runtime by openfut_production.production_state().
+FORBIDDEN_PORTS = PROD_PORTS
 FORBIDDEN_PATHS = ("/home/alex/openfut-promotion/state",)
-PROD_PIDS = {3631953: "prod utas-host", 3374264: "prod Core"}
 
 # The staging port block. One obvious place; every one of these is asserted free.
 # 42227 (the first choice for the redirector) is permanently occupied by
@@ -178,7 +186,7 @@ def ok(msg: str) -> None:
     print(f"  [ OK ] {msg}")
 
 
-class Fatal(RuntimeError):
+class Fatal(ProductionError):
     """Anything that must abort bring-up loudly rather than degrade."""
 
 
@@ -200,31 +208,12 @@ def check_port_allowed(port: int, what: str) -> None:
         raise Fatal(f"REFUSING: {what} port {port} is a PRODUCTION port")
 
 
-def listening_ports() -> set[int]:
-    """Every TCP port in state LISTEN in this network namespace, read straight from
-    the kernel socket table.
-
-    A trial bind() is the wrong test: after a server exits, its accepted sockets sit
-    in TIME_WAIT holding the same local port, so bind() reports EADDRINUSE for a
-    minute even though nothing is serving -- and every server here sets SO_REUSEADDR
-    and would bind fine. This mirrors `ss -ltn` (and host-lifecycle.sh's
-    hl_port_listening), which is the question actually being asked."""
-    ports: set[int] = set()
-    for path in ("/proc/net/tcp", "/proc/net/tcp6"):
-        try:
-            with open(path) as fh:
-                next(fh, None)  # header
-                for line in fh:
-                    fields = line.split()
-                    if len(fields) < 4 or fields[3] != "0A":  # TCP_LISTEN
-                        continue
-                    ports.add(int(fields[1].rsplit(":", 1)[1], 16))
-        except OSError:
-            continue
-    return ports
-
-
 def port_free(port: int) -> bool:
+    """A trial bind() is the wrong test: after a server exits, its accepted sockets
+    sit in TIME_WAIT holding the same local port, so bind() reports EADDRINUSE for a
+    minute even though nothing is serving -- and every server here sets SO_REUSEADDR
+    and would bind fine. listening_ports() mirrors `ss -ltn` (and
+    host-lifecycle.sh's hl_port_listening), which is the question actually asked."""
     return port not in listening_ports()
 
 
@@ -271,14 +260,25 @@ def cmdline_of(pid: int) -> str:
         return ""
 
 
+_PROD_BASELINE: ProductionState | None = None
+
+
 def assert_prod_alive(where: str) -> None:
-    for pid, what in PROD_PIDS.items():
-        if not pid_alive(pid):
-            raise Fatal(f"{what} pid {pid} is NOT alive at {where} -- stop and investigate")
-    ok(
-        f"production untouched at {where}: "
-        + ", ".join(f"{what} pid {pid} alive" for pid, what in PROD_PIDS.items())
-    )
+    """Prove production is untouched.
+
+    The first call records the baseline; every later call must observe the SAME
+    container pids publishing the SAME ports, and every published port must still
+    be listening. Pids are read from the container runtime each time because a
+    restarted container gets a new one.
+    """
+    global _PROD_BASELINE
+    state = production_state()
+    state.assert_serving()
+    if _PROD_BASELINE is None:
+        _PROD_BASELINE = state
+    else:
+        state.assert_unchanged(_PROD_BASELINE)
+    ok(f"production untouched at {where}: " + ", ".join(state.describe()))
 
 
 # --- HTTP ---------------------------------------------------------------------------
@@ -1091,7 +1091,7 @@ def main() -> int:
         print_summary(lay, args.variant, args.coins_processed, args.count_mode,
                       args.roster_host, records)
         return 0
-    except Fatal as exc:
+    except ProductionError as exc:
         print(f"\nFATAL: {exc}", file=sys.stderr)
         if started:
             print("  rolling back the partial bring-up...", file=sys.stderr)