fix(release): accept active launchctl state for portal tunnel preflight

Tunnel agents can report spawn scheduled while the SSH forward is already
healthy; treating that as failure caused successful releases to roll back.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/release-portal-runtime-prod.sh

@@ -618,9 +618,9 @@ EOF
   launchctl bootstrap "${LAUNCHD_GUI}" "${HOME}/Library/LaunchAgents/${tunnel_label}.plist" >/dev/null 2>&1 || true
   launchctl enable "${LAUNCHD_GUI}/${tunnel_label}" >/dev/null 2>&1 || true
   launchctl kickstart -k "${LAUNCHD_GUI}/${tunnel_label}" >/dev/null 2>&1 || true
-  sleep 2
+  sleep 5
 
-  if ! launchctl print "${LAUNCHD_GUI}/${tunnel_label}" 2>/dev/null | grep -q 'state = running'; then
+  if ! launchctl print "${LAUNCHD_GUI}/${tunnel_label}" 2>/dev/null | grep -Eq 'state = (running|active)'; then
     echo "portal tunnel failed to start (${tunnel_label})" >&2
     return 1
   fi