fix(infra): F1+F2 - Fix port comments and add per-leg assertions

F1: Fixed leg comments to match the actual ports
- Line 207: Docker Stats now shows :9324 (was :9323)
- Line 215: PVE Exporter now shows :9221 (was :9324)
These were the exact pairing this PR exists to correct.

F2: Added per-leg assertions that prove which leg owns which port
The new assertions verify:
1. Docker Stats leg uses $DOCKER_STATS_PORT constant
2. PVE Exporter leg uses $PVE_EXPORTER_PORT constant
3. DOCKER_STATS_PORT constant is set to 9324
4. PVE_EXPORTER_PORT constant is set to 9221

Proof the new assertions bite:
Under the both-constants-swapped mutation (DOCKER_STATS_PORT=9221,
PVE_EXPORTER_PORT=9324), the suite fails with 25 passed / 2 failed
(failing exactly the two constant-value assertions). This proves the
per-leg assertions pin which leg owns which port, not just that both
ports appear somewhere in the SSH log.

Branch: fix/infra-monitoring-probe-ports-20260919

scripts/test_infra_monitoring.sh

@@ -127,7 +127,23 @@ assert "Docker Stats probed at port 9324 via SSH" \
 assert "PVE Exporter probed at port 9221 via SSH" \
     'grep -q "9221" "$SSH_LOG"'
 
-# ── 5a. Stale port 9323 (dockerd) NOT probed ──────────────────────────────
+# ── 5a. Per-leg assertions (proves which leg owns which port) ──────────────
+# The script source must show Docker Stats using $DOCKER_STATS_PORT and
+# PVE Exporter using $PVE_EXPORTER_PORT in the correct leg sections
+assert "Docker Stats leg uses DOCKER_STATS_PORT constant" \
+    'grep -A 3 "# 6. Docker Stats" "$SCRIPT" | grep -q "\$DOCKER_STATS_PORT"'
+
+assert "PVE Exporter leg uses PVE_EXPORTER_PORT constant" \
+    'grep -A 3 "# 7. PVE Exporter" "$SCRIPT" | grep -q "\$PVE_EXPORTER_PORT"'
+
+# Verify the constants themselves are set to the correct values
+assert "DOCKER_STATS_PORT constant set to 9324" \
+    'grep -q "^DOCKER_STATS_PORT=\"9324\"" "$SCRIPT"'
+
+assert "PVE_EXPORTER_PORT constant set to 9221" \
+    'grep -q "^PVE_EXPORTER_PORT=\"9221\"" "$SCRIPT"'
+
+# ── 5b. Stale port 9323 (dockerd) NOT probed ──────────────────────────────
 assert "Port 9323 (dockerd) NOT in SSH log" \
     '! grep -q "9323" "$SSH_LOG"'