refactor(ports): let the cache module own the requireMetadata bypass

Keeps the scanner under the max-lines gate and puts the cache policy with the
cache rather than at the call site.

src/main/ports/local-workspace-platform-port-scanner.ts

@@ -130,15 +130,8 @@ async function scanDarwinLsofPorts(
     return { ports, metadataAvailable: false }
   }
   // Why: on a quiet machine the same servers keep listening, so the two metadata commands — the
-  // expensive half of the scan — would re-derive answers the last scan already has. A caller that
-  // requires metadata (the SIGTERM authorization re-scan) opts out: it must attribute the owner
-  // from this cycle's probe, never from a remembered cwd.
-  const { hydrated, pidsNeedingMetadata } = options.requireMetadata
-    ? {
-        hydrated: ports,
-        pidsNeedingMetadata: new Set(ports.flatMap((p) => (p.pid ? [p.pid] : [])))
-      }
-    : partitionListenersNeedingMetadata(ports)
+  // expensive half of the scan — would re-derive answers the last scan already has.
+  const { hydrated, pidsNeedingMetadata } = partitionListenersNeedingMetadata(ports, options)
   if (pidsNeedingMetadata.size === 0) {
     return { ports: hydrated, metadataAvailable: true }
   }

src/main/ports/local-workspace-port-scan-state.ts

@@ -123,12 +123,20 @@ export function rememberListenerMetadata(ports: readonly RawListeningPort[]): vo
  * metadata; and every entry is re-probed after METADATA_REPROBE_INTERVAL_SCANS so a process that
  * chdir'd while listening cannot keep a stale cwd forever.
  */
-export function partitionListenersNeedingMetadata(ports: readonly RawListeningPort[]): {
-  hydrated: RawListeningPort[]
-  pidsNeedingMetadata: Set<number>
-} {
+export function partitionListenersNeedingMetadata(
+  ports: readonly RawListeningPort[],
+  options: WorkspacePortScanOptions = {}
+): { hydrated: RawListeningPort[]; pidsNeedingMetadata: Set<number> } {
   metadataScanSequence += 1
   reusedListenerKeys = new Set()
+  // Why requireMetadata opts out: that caller is the SIGTERM authorization re-scan, so it must
+  // attribute the owner from this cycle's probe and never from a remembered cwd.
+  if (options.requireMetadata) {
+    return {
+      hydrated: [...ports],
+      pidsNeedingMetadata: new Set(ports.flatMap((port) => (port.pid ? [port.pid] : [])))
+    }
+  }
   const hydrated: RawListeningPort[] = []
   const pidsNeedingMetadata = new Set<number>()
   const reusableByPort = new Map<RawListeningPort, ProcessMetadata>()