feat(boot-test): test.yaml unboundPorts for ports opened only when a player connects

Some servers open a published port only once a player connects (through a
proxy, for example), so the boot test's port check can't see it after boot.
A template lists those ports as unboundPorts in its test.yaml, with the
reason. The first template that needs it lists one UDP port, until a real
client confirms how players reach it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/gbrgames/boottest_test.go

@@ -106,3 +106,18 @@ func TestBootTestPayloadAsksForPublishedPortsAndHold(t *testing.T) {
 		t.Errorf("missing secret: %v", err)
 	}
 }
+
+func TestBootTestPayloadLeavesOutUnboundPorts(t *testing.T) {
+	dir := t.TempDir()
+	game := filepath.Join(dir, "example")
+	os.MkdirAll(game, 0o755)
+	os.WriteFile(filepath.Join(game, "game.yaml"), []byte("id: example\nname: Example\ndefaultDockerImage: x\ndefaultPorts:\n  - 30000/tcp\n  - 30001/udp\n"), 0o644)
+	os.WriteFile(filepath.Join(game, "test.yaml"), []byte("unboundPorts:\n  - 30001/udp\n"), 0o644)
+	p, err := bootTestPayload(dir, "example", false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ports := p["expectPorts"].([]any); len(ports) != 1 || ports[0] != "30000/tcp" {
+		t.Errorf("expectPorts %v", ports)
+	}
+}