fix(device-edge): use compatible Node hardening

infra/deploy-runner/build-device-edge-vps-artifact.mjs

@@ -262,7 +262,8 @@ async function assertBoundary() {
       "\"runtimeUser\": \"nodedc-channel\"",
       "\"trackerIngress\": \"disabled\"",
       "User=nodedc-channel",
-      "node --jitless",
+      "ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
+      "MemoryDenyWriteExecute=no",
       "tcp dport 8443",
       "MemoryMax=128M",
       "MemorySwapMax=0",
@@ -279,6 +280,7 @@ async function assertBoundary() {
       "LocalForward",
       "tailscale-userspace",
       "DEVICE_EDGE_RELAY_UPSTREAM",
+      "--jitless",
     ]) {
       if (combined.includes(forbidden)) {
         throw new Error(`core_channel_boundary_violation:${forbidden}`);

infra/deploy-runner/nodedc-b2-vps-deploy

@@ -202,7 +202,7 @@ PHASE_FILE_SHA256 = {
         "vps/config/nftables-core-channel.conf":
             "1a04a5450042e80b8a20da3c6634dd6bc68693f191a463ba9a62984279d81d0c",
         "vps/systemd/nodedc-device-edge-channel.service":
-            "57c6c0c5eb952e1e196f50c410a8537468af145941b21dd4aad6ff0e8ca56249",
+            "afb2842db18d1863b2a089b4e89693f1ec17c78921457774ac9652f26b804856",
         "deployment/device-edge-vps-core-channel-v1.json":
             "938f6f7959b78e6be3a6e91a54dca2922fbd813f1a33dca5cebe0dc256a83a14",
     },

infra/deploy-runner/test_device_edge_vps_artifact.py

@@ -418,7 +418,13 @@ class DeviceEdgeVpsArtifactTest(unittest.TestCase):
         self.assertIn("DEVICE_EDGE_RELAY_SOURCE_POLICY=public-ipv4-only", relay_unit)
         self.assertIn("MemoryMax=192M", relay_unit)
         self.assertIn("User=nodedc-channel", channel_unit)
-        self.assertIn("node --jitless", channel_unit)
+        self.assertIn(
+            "ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node "
+            "/opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
+            channel_unit,
+        )
+        self.assertIn("MemoryDenyWriteExecute=no", channel_unit)
+        self.assertNotIn("--jitless", channel_unit)
         self.assertIn("MemoryMax=128M", channel_unit)
         self.assertIn("MemorySwapMax=0", channel_unit)
         self.assertIn("CPUQuota=50%", channel_unit)