[jonluca]

Summary

The HLS fixture's request workers read the bound port without synchronization while stop() resets it under the server lock. Read the redirect's default port under that same lock and keep the stored port private. Explicit redirect-port overrides keep their current behavior.

Test plan

• Apple M4 Max, macOS 27.0.1, Xcode 27.1.
• swift build --target aetherctl --disable-automatic-resolution --jobs 4 succeeds with the resolved pins and an isolated scratch directory. It reports the existing unused placement binding in ScrubPreviewCmd.swift; this change adds no warning.
• Exercised the built CLI over real loopback HTTP with generated TS-shaped bytes (no decoding required): media and master redirects, each with the assigned ephemeral port and an explicit override. All four return HTTP 302 with the expected Location.
• Reviewed every port access: initialization, start and stop writes, and the redirect read. No Thread Sanitizer claim is made.
• Documentation links and git diff --check pass.

Checklist

• Changelog and CLI documentation updated
• Conventional commit
• No public API or dependency changes

[Copilot]

🟢 Approval recommended

The narrowly scoped fix protects the port read without introducing nested locking or changing explicit overrides, and no blocking issues remain.

No open issues 🎉

What changed in this PR

This PR fixes an unsynchronized port read in the CLI’s HLS fixture server while preserving explicit redirect-port overrides.

Changes:

• Reads the default redirect port under the lifecycle lock and makes the stored port private.
• Documents the synchronization behavior in the CLI guide and changelog.

File	Description
Sources/​aetherctl/​HLSFixture.swift	Synchronizes the default redirect-port read and restricts port visibility.
docs/​cli.md	Explains how redirects read the bound port when no override is supplied.
CHANGELOG.md	Records the synchronization fix and unchanged override behavior.

_{Review effort: Balanced}