debug(local-docker): high host ports to test if 6443:6443 mapping triggers drop

v0.3.6 with the HostIP fix verified locally on Mac with high host
ports (16443:6443 + 18944:8944) -- bindings publish, /readyz
succeeds in <10s. On ubuntu-latest, ystack's host:6443 guest:6443
config produces NetworkSettings.Ports={} despite v0.3.6's fix.

Try the same shape that works on Mac and works for y-cluster's own
e2e on ubuntu-latest. If this run also publishes bindings, the
silent-drop is somehow tied to host:port matching guest:port (e.g.
host:6443 mapped to guest:6443).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: solsson

cluster-configs/local-docker/y-cluster-provision.yaml

@@ -13,13 +13,13 @@ context: local
 name: local
 
 portForwards:
-# 80 and 443 temporarily dropped while investigating the
-# silent-drop on ubuntu-latest. With all four forwards (including
-# the privileged ports) Docker Engine 28 publishes nothing
-# (NetworkSettings.Ports={}), even with v0.3.6's HostIP fix.
-# Restore once the root cause is identified.
-- {host: "6443", guest: "6443"}
-- {host: "8944", guest: "8944"}
+# Diagnostic: high host ports only. v0.3.6 with host:6443
+# guest:6443 produces NetworkSettings.Ports={} on ubuntu-latest;
+# 16443:6443 + 18944:8944 (high host ports) reproduces the
+# y-cluster e2e config that *does* publish bindings on the
+# same runner.
+- {host: "16443", guest: "6443"}
+- {host: "18944", guest: "8944"}
 
 # Mirror in-cluster registry hostnames at the magic ClusterIPs that
 # k3s/{60-builds-registry,61-prod-registry}/*-magic-numbers.yaml pin