Fix SF CLI integration mock server

[markdlv-sf]

No description provided.

[jcatt-sf]

Review of the TLS mock-server change. Overall a clean, well-commented PR — the inline notes are mostly diagnosability / latent / maintainability, with one ordering issue worth looking at before merge (the readiness gate racing the server's TLS setup, on scripts/mock_sf_server.py).

Common root cause. Several notes (the readiness race, the cert-file TOCTOU, the 9× path duplication, and the worktree placement) all trace back to one decision: generating the cert lazily inside the mock server's own startup, after installs. Generating it once in an early dedicated CI step — and separating cert-gen from the TLS bind, printing liveness before signaling ready — would collapse those four into a single fix.

(One earlier candidate — an allow_reuse_address ordering concern — was checked empirically and dropped as a false positive.)