[jonbaldie]

Summary

start.sh
  --check → varnishd_args -C → captured compiler diagnostics
  startup → varnishd_args -F → exec
                └─ shared -f, -a, -s, extra arguments

Fixes #157. The duplicated check list omitted the listen argument. Preserve shell validation and override behavior; document compile-mode socket binding and network/DNS requirements.

Evidence

• Before: bash test/e2e/assert-config-check.sh failed: /start.sh --check should reject listen host nohost.invalid:80 with resolution diagnostics.
  After: both modes reject nohost.invalid:80 and 999.1.1.1:80 with Got no socket(s).
• make test-smoke-runtime-interface passed, including real HTTP requests and command overrides.
• COMPOSE_PARALLEL_LIMIT=1 make -j1 test test-e2e-hard passed.
• Compile mode now checks the listener too; the in-container runtime test uses a free port to avoid colliding with its running daemon.

Merge Danger

Door: two-way

Blast Radius: preflight

Checks now resolve and bind the configured listener, as startup already does. Run preflight in the deployment network, separately from an instance using that port.