The canonical tag is now "[n<id>-]in-[<listen>:]<port>-<transport>"
instead of "[n<id>-]in-[<listen>:]<port>-<protocol>-<transport>".
Two TCP inbounds on the same port are already blocked by
checkPortConflict, so only the transport segment is needed to
disambiguate the legitimate tcp/udp coexistence case.
Existing DB rows keep their current tags via resolveInboundTag's
"reuse if free" branch — no migration needed (protocol-segment
form was never released).