Wire the live-test gate and pin the toolchain to 3.14

README advertised `uv run pytest -m live --live`, but there was no --live
option and no `live` marker registered — the command errored out, so the
one workflow that catches an upstream renaming a series did not exist.

- conftest adds --live and skips `live`-marked tests without it, so the
  default run stays hermetic (258 passed, 6 skipped, no network).
- tests/test_live_fleet.py drives the real code paths (collectors.*,
  NutMonitor.collect) against the fleet, both engines, and upsd. Each
  skips when its source is unset, and none of them may write — a battery
  test on live hardware is not a unit test. The host test polls twice
  because a rate has no second point on the first scrape.
- The agent's real-/proc test stays in the default run and is explicitly
  not `live`: it touches only the box running pytest.
- dev-tunnels.sh grows DEV_FORWARDS for services already listening
  remotely, which is how upsd gets reachable without opening 3493;
  pidfiles are now host+port so one host can carry two tunnels.
- requires-python, ruff and pyright were still on 3.13 while the venv and
  Containerfile are 3.14, so the lock resolved for a stack nobody deploys.

LLM-Generated: true

tests/test_agent.py

@@ -121,6 +121,8 @@ def test_cpu_modes_total_excludes_guest_ticks(tmp_path: Path) -> None:
 
 @linux_only
 def test_snapshot_against_the_live_system_is_complete() -> None:
+    """Real /proc and /sys, but only of the box running pytest — no network, so this is not
+    `live` (see tests/test_live_fleet.py): it belongs in the default run."""
     collector = host_agent.Collector("/")
     snap = collector.snapshot()
     for key in ("schema", "ts", "host", "cpu", "memory", "filesystems", "disk_io",