feat(device-edge): standardize Core channel on mTLS 443

infra/deploy-runner/build-device-edge-vps-artifact.mjs

@@ -152,7 +152,7 @@ try {
     publicIngress: phase === "relay"
       ? "tcp/9921"
       : phase === "core-channel"
-        ? "tcp/8443-mtls-only"
+        ? "tcp/443-mtls-only"
         : "disabled",
     commandTransport: "disabled",
     gelios: "untouched",
@@ -264,7 +264,9 @@ async function assertBoundary() {
       "User=nodedc-channel",
       "ExecStart=/opt/nodedc-b2-vps/runtime/node/bin/node /opt/nodedc-b2-vps/services/device-edge-channel/src/server.mjs",
       "MemoryDenyWriteExecute=no",
-      "tcp dport 8443",
+      "CapabilityBoundingSet=CAP_NET_BIND_SERVICE",
+      "AmbientCapabilities=CAP_NET_BIND_SERVICE",
+      "tcp dport 443",
       "MemoryMax=128M",
       "MemorySwapMax=0",
       "CPUQuota=50%",