Thanks to a Redditor, this is solved:

https://www.reddit.com/r/k3s/comments/1icg32i/make_traefik_listen_on_8443_and_8080_instead_of/

1. The yaml indentation was misaligned; too many spaces on some lines (not a cut-n-paste error). I copied someone else's work and didn't check it (note to self).

2. The 'expose' entries aren't needed and made traefik unhappy.

This worked:

apiVersion: helm.cattle.io/v1
kind: HelmChartConfig
metadata:
  name: traefik
  namespace: kube-system
spec:
  valuesContent: |-
    ports:
      web:
        port: 8088
        exposedPort: 8088
      websecure:
        port: 8443
        exposedPort: 8443