Refresh Lima SSH state before restart and allowlist sync

[jimpudar]

Summary

• Refresh the cached Lima SSH local port before using firewall or agent transport after a stop/start cycle.
• Wait for firewall SSH to become reachable before allow copies allowlists, instead of trusting VM state alone.
• Add a regression test that simulates a stale firewall SSH port and verifies the refreshed transport path.

Testing

• bun run test src/rootcell/rootcell.test.ts
• bun run typecheck
• bun run lint