Fix worker proxy relay leak and enable noVNC under --scale

_relay waited for both pipe directions (gather), leaking a task holding two sockets on every half-closed tunnel — visible as a flood of pending-task lines under load. Tear the tunnel down when either side closes (FIRST_COMPLETED + close both writers), matching the .NET LocalForwardingProxy's WhenAny. Also move the worker's noVNC to an ephemeral host port so replicas don't collide under 'docker compose up --scale worker=N'.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docker-compose.yml

@@ -45,5 +45,8 @@ services:
     depends_on:
       - c2
     ports:
-      - "6080:6080"                     # noVNC: http://localhost:6080/vnc.html
+      # Ephemeral host port so replicas don't collide under --scale. Find a worker's
+      # noVNC with `docker compose port worker 6080` (or `docker ps`), then open
+      # http://localhost:<mapped>/vnc.html to watch / solve a challenge.
+      - "6080"
     restart: unless-stopped