fix(dev_up): rootless podman cannot bind 80/443 — publish ingress higher

[mdheller]

scripts/dev_up.sh fails at cluster-create for any rootless podman user:

rootlessport cannot expose privileged port 80, you can add
'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024)

local/kind-cluster.yaml maps host 80/443 so ingress-nginx is reachable at localhost. Rootless podman cannot bind below ip_unprivileged_port_start, so the create dies before any workload exists — the dev loop is unavailable, not degraded. Given the estate is podman-first on workstations, this likely affects most users.

Why not just tell people to fix sysctl

It needs root, it's a persistent host change, and it's invisible to anyone who didn't read the error. Poor trade for a dev loop.

Instead the runtime is detected and the ingress is published where it can bind — 8080/8443 under rootless podman, 80/443 everywhere else — with a warning naming the ports. SHIM_SHELL_BASE follows so porter-shim's links stay correct. The committed kind-cluster.yaml keeps the canonical 80/443 shape; ports are substituted at create time, so one file serves both runtimes.

A correction worth reading

My first commit's sed used an end-of-line anchor (hostPort: 80$). The mappings are inline flow style, so it matched nothing and the cluster came up with the original privileged ports — the fix silently did nothing, which is worse than not shipping it. Second commit anchors on the preceding containerPort and verifies both pairs:

host ports	resulting mappings
80/443	[(80, 80), (443, 443)]
8080/8443	[(80, 8080), (443, 8443)]

Context

Found while bringing the noetica-impair rig up on the continuum local PaaS. Other agents are active here, so this is deliberately on a branch and is one possible pattern, not the only one — a conditional config or a generator would serve equally. The property that matters is that a rootless-podman user can run dev_up.sh at all.