pub const FD_HEADROOM: u64 = 64;
Descriptors assumed to be needed beyond the tunnel quota: the endpoint socket, the request streams, stdio, and the certificate reads a reload does.