Gate reef web ports on exposure grants

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa

goss/baseline.yaml.j2

@@ -67,6 +67,9 @@ command:
 {% for rule in ufw_extra_allowed | default([]) %}
       - '/{{ rule.port }}\/{{ rule.proto | default("tcp") }}\s+ALLOW/'
 {% endfor %}
+{% for port in public_web_ports | default([]) %}
+      - '/{{ port }}\/tcp\s+ALLOW\s+Anywhere/'
+{% endfor %}
 
   # Exact allowlist size: extra hand grants must fail, not only missing ones.
   # The previous assertion matched /6443\/tcp.*ALLOW/, which passes identically