fix(gateway): keep production app ports private

packages/cli/src/update.ts

@@ -646,6 +646,15 @@ const MIGRATIONS: Migration[] = [
       // Existing workspaces can invoke `wrnexus production` without generated-file changes.
     },
   },
+  {
+    version: "0.2.65",
+    id: "private-production-app-listeners",
+    description:
+      "Restricts workspace-managed production app servers to loopback so external clients must use the gateway.",
+    apply() {
+      // The production gateway applies the private bind address automatically.
+    },
+  },
 ];
 
 /** Release tooling uses this to require an explicit migration entry per version. */