fix(cli): bind a free port for edge-runtime diff containers

[Coly010]

What changed

The schema diff path (supabase db pull and friends) executes one-shot scripts — migra, pg-delta, pgcache — by running edge-runtime start --main-service=. inside a container. Both call sites (RunEdgeRuntimeScript in internal/utils/edgeruntime.go and diffWithStream in internal/db/diff/diff.go) launched it with NetworkMode: host but without a --port flag.

edge-runtime start is an HTTP server and always binds a TCP listener. With no explicit port it bound the edge-runtime default port, and with host networking that bind landed directly in the host (Docker VM) network namespace. When the port was already taken — a leftover diff container from an interrupted run, the local stack, or anything else on that port — the bind failed and the container exited 1.

This change adds a shared EdgeRuntimeStartCmd helper that allocates a free host port and passes it as --port, used by both call sites, so concurrent or leftover one-shot containers no longer contend for the default port. On the rare port-allocation failure it falls back to the previous portless command.

Why

Reported in #5407: supabase db pull on Windows fails at "Diffing schemas..." with Error: Address already in use (os error 98). Host networking on Docker Desktop (Windows/macOS) shares the VM namespace and makes the default-port collision far more likely. functions serve was never affected because it already passes an explicit --port (serve.go:190).

Reviewer notes

• Covers all diff engines that go through RunEdgeRuntimeScript: migra, pg-delta (×3), pgcache, apply — plus the streaming diffWithStream.
• With Docker Desktop host networking the port is probed on the real host while the bind happens in the VM namespace, so a probed-free port isn't strictly guaranteed free in the VM. Moving off the single shared default to a random ephemeral port removes virtually all real-world collisions; a fully bulletproof fix would be moving these containers to bridge networking with port mapping (like serve.go), which can follow separately.

Fixes #5407

[coveralls]

Coverage Report for CI Build 26814852769

Coverage increased (+0.001%) to 63.906%

Details

• Coverage increased (+0.001%) from the base build.
• Patch coverage: No coverable lines changed in this PR.
• 8 coverage regressions across 2 files.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

8 previously-covered lines in 2 files lost coverage.

File	Lines Losing Coverage	Coverage
internal/utils/git.go	5	53.33%
internal/utils/edgeruntime.go	3	90.7%

---

Coverage Stats

Relevant Lines:	15792
Covered Lines:	10092
Line Coverage:	63.91%
Coverage Strength:	7.08 hits per line

---

💛 - Coveralls