feat(device-edge): standardize Core channel on mTLS 443

device-plane/deployment/device-edge-core-channel-v1.json

@@ -6,7 +6,7 @@
   "transport": {
     "protocol": "http2-bidirectional-stream",
     "tls": "TLSv1.3-mutual-authentication",
-    "edgeListen": "0.0.0.0:8443",
+    "edgeListen": "0.0.0.0:443",
     "endpointSource": "device-control-core.edge-registration",
     "browserAccess": "forbidden",
     "bearerOnlyAuthentication": "forbidden",
@@ -30,7 +30,7 @@
     "allowedEdgeListeners": [
       "management-ssh",
       "raw-device-tcp/9921",
-      "core-channel-mtls/8443"
+      "core-channel-mtls/443"
     ]
   },
   "messageContract": {

device-plane/deployment/device-edge-vps-core-channel-v1.json

@@ -9,7 +9,7 @@
   "runtimeUser": "nodedc-channel",
   "runtimeService": "nodedc-device-edge-channel.service",
   "runtime": "accepted-node-v22.23.2-no-docker",
-  "publicIngress": "tcp/8443-mtls-only",
+  "publicIngress": "tcp/443-mtls-only",
   "health": "127.0.0.1:18222",
   "trackerIngress": "disabled",
   "rawDeviceTcp9921": "closed",
@@ -18,6 +18,7 @@
   "privateKeyBoundary": "runner-managed-host-local-only",
   "peerTrustPrerequisite": "exact-pinned-self-signed-core-certificate-and-fingerprint",
   "tls": "TLSv1.3+h2+mutual-authentication",
+  "networkPrivilege": "CAP_NET_BIND_SERVICE-only-for-non-root-tcp-443",
   "resourceCeilings": {
     "memory": "128M",
     "swap": "0",
@@ -45,10 +46,10 @@
     "edge-server-and-core-client-self-signed-identities-mutually-pinned",
     "core-initiated-channel-accepted",
     "unknown-core-certificate-rejected",
-    "public-8443-only-beside-management-ssh",
+    "public-443-only-beside-management-ssh",
     "tracker-tcp-9921-closed",
     "loopback-health-contract",
     "resource-ceilings-present"
   ],
-  "rollback": "close-8443-stop-channel-restore-exact-accepted-foundation-without-backhaul-or-relay"
+  "rollback": "close-443-stop-channel-restore-exact-accepted-foundation-without-backhaul-or-relay"
 }