Early cleanup ignores the .gitreview SSH port

[ModeSevenIndustrialSolutions]

Summary

Found by Copilot while reviewing #447 (against code from #446).

Early parameter derivation exports GERRIT_SERVER from .gitreview but not
GERRIT_SERVER_PORT. The closed-PR dispatch runs before the orchestrator,
and the SSH abandon path (gerrit_pr_closer._abandon_gerrit_change) reads
the ambient GERRIT_SERVER_PORT, so a repository whose .gitreview says
port=29420 is contacted on 29418 during cleanup even though the pipeline
itself pushes on 29420.

Why exporting the port from derivation is not enough on its own

The composite action passes GERRIT_SERVER_PORT: ${{ inputs.GERRIT_SERVER_PORT }}
with a default of "29418", so the environment variable is always non-blank
in Actions and apply_config_to_env never writes a derived value over it.
This is the provenance gap #444 recorded: an integer port cannot say whether
the operator set it or the default applied. #446 documented the pairing rule
(port travels with the host) for the orchestrator; this issue is about
making the early cleanup path honour the same rule.

Fix

Either:

1. Stop defaulting GERRIT_SERVER_PORT in action.yaml / the reusable
   workflow (blank means "not set"), have derivation export the .gitreview
   port alongside the host with the same replacement/provenance handling as
   GERRIT_SERVER, and let Inputs default to 29418 only when nothing
   supplied one; or
2. Have the cleanup paths read the port from the resolved GerritInfo
   (host + port as one target) rather than from the ambient environment.

Option 2 keeps the fix inside the tool; option 1 also closes #444's option 2.

Acceptance criteria

• Closed-PR cleanup against a .gitreview with a non-default port
  connects on that port
• A test covering the derivation → close-handler port path

[ModeSevenIndustrialSolutions]

Fixed by #449 (merged in 047f4cd, released in v2.2.2); this was left open by accident. The PR body read Closes #444, #448., and GitHub only links the issue that immediately follows a closing keyword, so #444 closed and this one did not.

#449 took option 1: GERRIT_SERVER_PORT no longer has a default in action.yaml, the reusable workflow or the CLI. Early derivation now exports the .gitreview port alongside the host, with its own provenance (DerivedParameters.port_from_gitreview), so _abandon_change_via_ssh_if_possible reads the port the pipeline pushes on.

Acceptance criteria:

• Closed-PR cleanup against a .gitreview with a non-default port connects on that port
• A test covering the derivation → close-handler port path: test_close_handler_abandons_on_the_gitreview_port in tests/test_config_helpers.py, alongside test_gitreview_port_is_exported_with_the_host and test_gitreview_port_is_exported_even_with_an_explicit_host