#3900 @swamp/cve/tailworm: after mitigate caps headscale, the rescan still tells you to set MemoryMax and Restart=always

What happens

On a host running headscale 0.29.5 with listen_addr 0.0.0.0:8080, mitigate with dryRun=false applies the headscale cap: systemctl show headscale then reports MemoryMax=2147483648 and Restart=always, and the stored scan has memoryMax 2147483648 and restart always. The rescan still lists the recommendation: headscale: set MemoryMax and Restart=always (mitigate does this), put a rate-limiting reverse proxy in front of the registration endpoints, and keep it reachable only from an admin network or VPN.

The headscale-dos exposure stays because of the public listen address, which is correct, but the recommendation text is fixed. It tells the reader to do what mitigate just did.

Expected

Once memoryMax is set and restart is always, the recommendation should drop the MemoryMax clause and keep only the reverse-proxy and exposure advice.

Repro

@swamp/cve/tailworm 2026.10.24.1, Debian 13 VM, headscale 0.29.5 and tailscaled 1.104.2. Run scan, then mitigate with dryRun=false, then scan again as root on the same host.

Found while capturing sample output for the swamp-club.com/cve/tailworm page (#3895).