PS> .\scripts\Start-AzureVirtualNetworkManagerWorkshop.ps1 `
    -SubscriptionId $subscriptionId -Stage Mesh

[PASS] initial three-member dynamic network group is ready.

core-vm$ timeout 6 bash -c '</dev/tcp/<edge-private-ip>/8080'
PORT=8080 RESULT=BLOCKED

core-vm$ timeout 6 bash -c '</dev/tcp/<edge-private-ip>/8443'
PORT=8443 RESULT=BLOCKED

[PASS] Edge uses NetworkGroup=Mseh, so no ConnectedGroup route exists.
       Both proof ports fail exactly as designed.

The VM private address is masked; no public inbound rule is present.