A short-form port keeps its protocol and still gets its machine port

"3478/udp" read as one token was not a port, so it passed through and the
runtime published it wherever it liked: on ace, unifi's STUN and discovery
landed on random machine ports while every TCP pin beside them held. The
protocol is split off, the number is assigned as for any short form, and
the suffix rides along on the outside.

internal/catalogue/declaration.go

@@ -1576,14 +1576,23 @@ func publishedOn(resource map[string]any, module string, with Rendering) {
 			out = append(out, givenOuter(written, with.Given[module]))
 			continue
 		}
-		wanted, err := strconv.Atoi(strings.TrimSpace(written))
+		// A short form may carry the protocol — `"3478/udp"` — and the number is what the mesh
+		// assigns for; the protocol rides along. Read as one token, the `/udp` made the whole
+		// entry "not a port", and passing it through let the runtime publish it wherever it
+		// liked: unifi's STUN and discovery landed on random machine ports while every TCP pin
+		// beside them held.
+		mapping, protocol := written, ""
+		if cut := strings.LastIndex(written, "/"); cut >= 0 {
+			mapping, protocol = written[:cut], written[cut:]
+		}
+		wanted, err := strconv.Atoi(strings.TrimSpace(mapping))
 		if err != nil {
 			// Not a port at all. Passed through, so the host refuses it with its own words rather
 			// than this quietly dropping something somebody meant.
 			out = append(out, written)
 			continue
 		}
-		out = append(out, fmt.Sprintf("%d:%d", with.machinePort(module, wanted), wanted))
+		out = append(out, fmt.Sprintf("%d:%d%s", with.machinePort(module, wanted), wanted, protocol))
 	}
 	resource["ports"] = out
 }