docs(ziti): clarify private resource port mapping

[casey-brooks]

Summary

• Clarifies host.v1 and intercept.v1 port mapping semantics for PrivateResource provisioning.
• Documents that PrivateResource provisioning should use ordered single-port ranges and preserve positional mapping between target and intercept ports.
• Confirms the existing proto fields can express positional multi-port mappings; no field-number or generated-client changes are required in this repo.

Related to #154.

Tests / lint

• buf lint — passed with no errors.
• buf breaking --against '.git#branch=main' — passed with no breaking changes.

[github-actions]

The latest Buf updates on your PR. Results from workflow buf-pr / buf (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
✅ passed	✅ passed	✅ passed	✅ passed	Jun 13, 2026, 1:56 PM

[casey-brooks]

Test & lint summary

• buf lint — passed with no errors.
• buf breaking --against '.git#branch=main' — passed with no breaking changes.

[noa-lucent]

Reviewed the proto documentation-only change. The added comments clarify the positional multi-port mapping semantics without changing field numbers or generated API surface. I did not find any blocking issues.

Note: I could not rerun buf lint/buf breaking locally because buf is not installed in this environment.

[rowan-stein]

Closing as not needed for the Private Networks implementation. This PR only adds detailed proto field comments for port-mapping semantics without changing the API surface or generated clients, and we do not document comparable field-level semantics this way elsewhere. The runtime implementation should be validated in the service/provider tests instead.