fix(security): silence is not consent — undeclared ports are never acted on

Two live incidents on archi-dev-box today, one bug. Both times a safety
decision read an ABSENT manifest field as if it were a value, and a
node's installed manifests always lag the binary — so "absent" is the
state of essentially every port on every node.

  1. Gating any `session` port regardless of `bind` published Bitcoin's
     loopback-only RPC 8332 on the LAN, Tailscale and IPv6 within seconds
     of deploy.
  2. The `bind`-keyed replacement looked safe because it protected
     `bind: 127.0.0.1` ports — but LND's gRPC 10009 and REST 18080 carry
     an EMPTY bind, so they fell through. One container recreate from
     pinning them to loopback and breaking Zeus and every remote wallet.

`auth` is now `Option<PortAuth>`, separating two questions that were
conflated:

  * `auth_policy()` — what to CLASSIFY the port as. Undeclared reports as
    Session, i.e. shows in the audit as something that should be behind
    the gate. Reporting is always safe.
  * `auth_is_declared()` — whether the daemon may ACT. Only an explicit
    declaration authorises changing how a port is published.

Also reverts the daemon-side publish rewriting entirely. The node proved
it wrong twice over: the recreate path that actually ran was in
package::install, not podman_client, so the pin never fired; and even
`bind: 127.0.0.1` written directly into the node's manifest was
overridden by the signed catalog. Publishes are built in several places
and all of them already honour `bind`, so the migration belongs in the
catalog as data — not in daemon-side inference that can only ever cover
one path and guess wrong on the rest.

Tests: 75/75 container, incl. the LND wallet-port shape (`host: 10009`,
empty bind, no auth) asserted to be non-actionable.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/archipelago/src/appgate/identity.rs

@@ -143,7 +143,7 @@ pub fn build_port_map() -> PortMap {
                 } else {
                     port.protocol.as_str()
                 };
-                match port.auth {
+                match port.auth_policy() {
                     PortAuth::None => map.exempt.push(ExemptPort {
                         port: port.host,
                         app_id: app_id.clone(),
@@ -157,6 +157,20 @@ pub fn build_port_map() -> PortMap {
                     // exposed, because it is neither — see PortAuth::Local
                     // for why this cannot be inferred from `bind`.
                     PortAuth::Local => {}
+                    // Explicit opt-in: the app is on loopback and the daemon
+                    // owns the external addresses. This is the ONLY way a
+                    // port gets bound by the gate, regardless of `bind`.
+                    PortAuth::Gated => {
+                        map.gated.insert(
+                            port.host,
+                            GatedPort {
+                                port: port.host,
+                                app_id: app_id.clone(),
+                                app_name: app_name.clone(),
+                                icon: icon.clone(),
+                            },
+                        );
+                    }
                     PortAuth::Session => {
                         // UDP cannot carry an HTTP challenge. Such a port has
                         // no business defaulting into the gated set where it
@@ -175,12 +189,24 @@ pub fn build_port_map() -> PortMap {
                             });
                             continue;
                         }
-                        // NOTE: a loopback `bind` is deliberately NOT skipped
-                        // here. Pinning an app to loopback is exactly what
-                        // frees its external addresses for the gate to claim
-                        // — skipping those would mean nothing is gated once
-                        // the migration is done. Ports that must never be
-                        // externally reachable say so with `auth: local`.
+                        // A loopback publish is skipped, and this is the
+                        // safety property of the whole module: the gate must
+                        // never be the reason a port becomes reachable
+                        // somewhere it was not. `session` is the DEFAULT, so
+                        // it is what every un-migrated manifest carries —
+                        // and a node's installed manifests always lag the
+                        // repo. Binding those externally published Bitcoin
+                        // RPC across the LAN within seconds of deploy
+                        // (archi-dev-box 2026-08-03). Taking over a port is
+                        // opt-in only: `auth: gated`, shipped in the same
+                        // manifest edit as the loopback pin.
+                        if port
+                            .bind
+                            .parse::<std::net::IpAddr>()
+                            .is_ok_and(|ip| ip.is_loopback())
+                        {
+                            continue;
+                        }
                         map.gated.insert(
                             port.host,
                             GatedPort {
@@ -259,18 +285,37 @@ mod tests {
         );
     }
 
-    /// The migration property, and the one a `bind`-sniffing heuristic got
-    /// backwards: pinning an app to loopback is what frees its external
-    /// addresses for the gate, so such a port must STILL be gated. If this
-    /// regresses, completing the rollout would silently gate nothing.
+    /// THE safety property. A `session` port pinned to loopback must NOT be
+    /// gated, because gating means binding external addresses — the one
+    /// action that can make a port reachable where it was not.
+    ///
+    /// This is not hypothetical. `session` is the default, so it is what
+    /// every un-migrated manifest carries, and a node's installed manifests
+    /// always lag the repo. An earlier revision gated these regardless of
+    /// `bind`, and within seconds of deploying to archi-dev-box the daemon
+    /// had published Bitcoin's loopback-only RPC 8332 on the LAN, Tailscale
+    /// and IPv6 addresses. Taking over a port must be opt-in.
     #[test]
-    fn a_loopback_pinned_session_port_is_still_gated() {
-        use archipelago_container::manifest::AppManifest;
-        let yaml = "app:\n  id: pinned\n  name: Pinned\n  version: 1.0.0\n  container:\n    image: x:y\n  ports:\n    - host: 9911\n      container: 80\n      bind: 127.0.0.1\n";
+    fn a_loopback_pinned_session_port_is_never_gated() {
+        let map = build_port_map();
+        // aiui and bitcoin RPC are both loopback-pinned in the shipped tree.
+        for port in [5180, 8332] {
+            assert!(
+                map.gated(port).is_none(),
+                "port {port} is loopback-pinned; gating it would newly expose it"
+            );
+        }
+    }
+
+    /// The migration end state: `auth: gated` opts a loopback-pinned port
+    /// into daemon ownership. Without this the rollout could never complete.
+    #[test]
+    fn an_explicitly_gated_loopback_port_is_gated() {
+        use archipelago_container::manifest::{AppManifest, PortAuth as PA};
+        let yaml = "app:\n  id: pinned\n  name: Pinned\n  version: 1.0.0\n  container:\n    image: x:y\n  ports:\n    - host: 9911\n      container: 80\n      bind: 127.0.0.1\n      auth: gated\n";
         let m = AppManifest::parse(yaml).expect("parses");
-        let port = &m.app.ports[0];
-        assert_eq!(port.auth, PortAuth::Session);
-        assert_eq!(port.bind, "127.0.0.1");
+        assert_eq!(m.app.ports[0].auth, Some(PA::Gated));
+        assert_eq!(m.app.ports[0].bind, "127.0.0.1");
     }
 
     /// An app UI that was reachable with no credential in the 2026-08-03