start.sh: kill stale tinfoil-proxy before bind + fail hard if the proxy never comes up

The 3301 'address already in use' on process-level restarts left an unmanaged
old proxy serving (pre-update code/flags) while the new one died. Also: if the
proxy never binds, exit 1 instead of exec-ing LiteLLM against a dead 3301 —
that masqueraded as a provider outage. Cache continuity: with
TINFOIL_USER_CACHE_SECRET now pinned (env, 2026-10-22), restarts keep Tinfoil's
prompt-cache warm either way.

start.sh

@@ -170,11 +170,33 @@ if [ ! -f "$TINFOIL_PROXY_BIN" ]; then
 fi
 
 echo "Starting Tinfoil proxy on 127.0.0.1:3301..."
+# Kill any stale proxy from a previous start attempt first — on process-level
+# restarts (container NOT recreated) the old proxy still holds 127.0.0.1:3301
+# and the new one dies with "bind: address already in use", leaving an
+# unmanaged listener running pre-update code/flags.
+pkill -f "tinfoil-proxy" 2>/dev/null || true
+sleep 1
 "$TINFOIL_PROXY_BIN" -b 127.0.0.1 -p 3301 &
 TINFOIL_PROXY_PID=$!
 echo "Tinfoil proxy PID: $TINFOIL_PROXY_PID"
 
-# Give the proxy a moment to verify the enclave attestation
-sleep 3
+# Give the proxy a moment to verify the enclave attestation, and FAIL HARD if
+# it didn't come up — LiteLLM routing to a dead 3301 breaks every tinfoil
+# request, and a silent continue makes that look like a provider outage.
+proxy_up=0
+for _ in $(seq 1 10); do
+    if kill -0 "$TINFOIL_PROXY_PID" 2>/dev/null && \
+       (exec 3<>"/dev/tcp/127.0.0.1/3301") 2>/dev/null; then
+        exec 3>&- 3<&- || true
+        proxy_up=1
+        break
+    fi
+    sleep 1
+done
+if [ "$proxy_up" != "1" ]; then
+    echo "FATAL: tinfoil-proxy did not bind 127.0.0.1:3301" >&2
+    exit 1
+fi
+echo "Tinfoil proxy is up on 127.0.0.1:3301"
 
 exec litellm --config "$CONFIG_FILE" --port 4000 --host 0.0.0.0