accept empty Docker port bindings in M4.7 preflight

scripts/Invoke-M47CanonicalGraphShadow.ps1

@@ -136,6 +136,10 @@ function Write-Utf8NoBom([string]$Path, [string]$Value) {
     [IO.File]::WriteAllText($Path, $Value, $encoding)
 }
 
+function Test-NoPublishedPorts([object]$Container) {
+    return @($Container.HostConfig.PortBindings.PSObject.Properties).Count -eq 0
+}
+
 if ($env:COMPUTERNAME -cne "DESKTOP-OPJ8J04") {
     throw "M4.7 shadow release is pinned to DESKTOP-OPJ8J04"
 }
@@ -388,7 +392,7 @@ try {
         $tritonCandidate.Id -cne $tritonCandidateId -or
         $tritonCandidate.Image -cne $descriptor.container.image_id -or
         -not $tritonCandidate.HostConfig.ReadonlyRootfs -or
-        $null -ne $tritonCandidate.HostConfig.PortBindings
+        -not (Test-NoPublishedPorts $tritonCandidate)
     ) {
         throw "M4.7 isolated Triton contract changed"
     }
@@ -407,7 +411,7 @@ try {
             $candidate.Image -cne $descriptor.container.image_id -or
             $candidate.HostConfig.NetworkMode -cne ("container:{0}" -f $tritonCandidate.Id) -or
             -not $candidate.HostConfig.ReadonlyRootfs -or
-            $null -ne $candidate.HostConfig.PortBindings
+            -not (Test-NoPublishedPorts $candidate)
         ) {
             throw "M4.7 graph candidate isolation contract changed"
         }

tests/test_m47_worker_graph_shadow_artifact.py

@@ -132,3 +132,5 @@ def test_m47_runner_calls_only_the_canonical_graph_entrypoint() -> None:
     assert 'Write-Output "DURABLE_WORKER_ACTION=none"' in runner
     assert 'Write-Output "HISTORICAL_TRITON_ACTION=none"' in runner
     assert 'Write-Output "ISOLATED_TRITON_ACTION=removed"' in runner
+    assert "function Test-NoPublishedPorts" in runner
+    assert "PortBindings.PSObject.Properties" in runner