fix: `validate-env.yml` CI uses non-canonical ports in synthetic `.env`

[patil2001]

Summary

Workflow sets SEARXNG_PORT=8080, TOKEN_SPY_PORT=3003; canonical defaults are 8888 and 3005.

Impact: Production user/operator failure on Osmantic/ODS main

Files:

• .github/workflows/validate-env.yml
• config/ports.json
• .env.schema.json

Repro

On a production-like Osmantic/ODS main checkout:

1. Hit the failure mode described in Summary (severity: Medium).
2. Observe the broken behavior / incorrect exit / missing guard from the root cause above.
3. Confirm no overlapping open PR (dedup: No open issue. No open PR.).

Fix

Implement a minimal, distro-/path-correct fix in the listed files (no scope creep).

• Address the root cause directly (do not paper over with || true / broad catches).
• Prefer resolving runtime values from the environment/repo (like apt-cache madison) over hardcoding distro-specific version strings when the same bug class applies.
• Add a regression test under ods/tests/ (or matching suite) that fails without the fix and passes with it.

Context

Filed from Desktop issues.md entry #36 via one-click scout pipeline.
Rationale: Unfiled Desktop issues.md #36 (no GitHub issue yet)