I think we should be careful about using up ports in user workspaces, but don't really have a suggestion for an improvement here. Maybe this debug endpoint could be enabled on-demand or something in future.

Yeah, I was thinking about that while writing this. I think users probably wouldn't be too stoked we're automatically taking up some commonly used ports. Another thing we could do is use some of our reserved ports in Wireguard, but then a user couldn't port-forward to them.