fix: admin-up veth-wan-ovs via networkd (mulga-998.b Fix 1 follow-up)

Fix 1 persisted the veth pair across reboot via
15-spinifex-veth-wan.{netdev,network}, but only configured
veth-wan-br. Its peer veth-wan-ovs had no .network unit, so
networkd left it unmanaged and admin-DOWN after reboot. That
cascades: peer goes LOWERLAYERDOWN, br-wan loses carrier,
external DHCP/NAT path broken — despite vpcd correctly
detecting mode=veth and the sanity check passing.

OVS does not admin-up external (non-internal) ports — that's
networkd's job. Pre-reboot the setup-ovn.sh 'ip link set
veth-wan-ovs up' made it work, but that doesn't persist.

Write a second unit 16-spinifex-veth-wan-ovs.network with
ConfigureWithoutCarrier=yes so networkd flips admin state
without taking ownership of bridge/address assignment (OVS
retains that). Cleanup paths in the non-veth branch of
setup-ovn.sh and reset-dev-env.sh updated to remove the new
unit too.

Verified live via 'networkctl reload': veth-wan-ovs and
veth-wan-br both UP, br-wan LOWER_UP. Reboot drill per
docs/development/bugs/dhcp-vpcd-issues.md 'Live drill 1'
still required to confirm persistence.

scripts/reset-dev-env.sh

@@ -110,10 +110,12 @@ fi
 # Remove veth persistence units (Fix 1, mulga-998.b). Without this, systemd-networkd
 # recreates the veth on next reboot even after a full dev reset.
 if [ -e /etc/systemd/network/15-spinifex-veth-wan.netdev ] || \
-   [ -e /etc/systemd/network/15-spinifex-veth-wan.network ]; then
+   [ -e /etc/systemd/network/15-spinifex-veth-wan.network ] || \
+   [ -e /etc/systemd/network/16-spinifex-veth-wan-ovs.network ]; then
     echo "  Deleting veth persistence units"
     sudo rm -f /etc/systemd/network/15-spinifex-veth-wan.netdev \
-               /etc/systemd/network/15-spinifex-veth-wan.network
+               /etc/systemd/network/15-spinifex-veth-wan.network \
+               /etc/systemd/network/16-spinifex-veth-wan-ovs.network
     sudo networkctl reload 2>/dev/null || true
 fi
 

scripts/setup-ovn.sh

@@ -312,7 +312,8 @@ if [ -n "$WAN_BRIDGE" ]; then
     # bridge plumbing (Fix 1, mulga-998.b, per D17).
     if [ "$WAN_BRIDGE_MODE" != "veth" ]; then
         sudo rm -f /etc/systemd/network/15-spinifex-veth-wan.netdev \
-                   /etc/systemd/network/15-spinifex-veth-wan.network
+                   /etc/systemd/network/15-spinifex-veth-wan.network \
+                   /etc/systemd/network/16-spinifex-veth-wan-ovs.network
         sudo networkctl reload 2>/dev/null || true
         sudo ovs-vsctl --if-exists del-port "$WAN_BRIDGE" veth-wan-ovs
         sudo ip link del veth-wan-br 2>/dev/null || true
@@ -377,6 +378,7 @@ if [ -n "$WAN_BRIDGE" ]; then
             # silently falls back to direct mode (Fix 1, mulga-998.b).
             VETH_NETDEV="/etc/systemd/network/15-spinifex-veth-wan.netdev"
             VETH_NETWORK="/etc/systemd/network/15-spinifex-veth-wan.network"
+            VETH_OVS_NETWORK="/etc/systemd/network/16-spinifex-veth-wan-ovs.network"
             sudo tee "$VETH_NETDEV" >/dev/null <<NETDEV
 [NetDev]
 Name=veth-wan-br
@@ -392,9 +394,24 @@ Name=veth-wan-br
 [Network]
 Bridge=$LINUX_BRIDGE
 ConfigureWithoutCarrier=yes
+NETWORK
+            # Second unit admin-ups the OVS end of the pair. OVS owns the port
+            # (enslaved via ovs-vsctl add-port above) but does not flip admin
+            # state on external ports — that's networkd's job. Without this,
+            # veth-wan-ovs stays DOWN after reboot, peer goes LOWERLAYERDOWN,
+            # br-wan loses carrier (Fix 1 follow-up, mulga-998.b).
+            sudo tee "$VETH_OVS_NETWORK" >/dev/null <<NETWORK
+[Match]
+Name=veth-wan-ovs
+
+[Link]
+RequiredForOnline=no
+
+[Network]
+ConfigureWithoutCarrier=yes
 NETWORK
             sudo networkctl reload 2>/dev/null || true
-            echo "  wrote $VETH_NETDEV + $VETH_NETWORK (veth persists on reboot)"
+            echo "  wrote $VETH_NETDEV + $VETH_NETWORK + $VETH_OVS_NETWORK (veth persists on reboot)"
             ;;
 
         direct)