test: cover verifyBridgeMode empty-parameter branches

Add four branch tests for verifyBridgeMode that were missing from the
initial Fix 2 commit:
- direct mode rejects empty external_interface
- direct mode rejects empty dhcp_bind_bridge
- veth mode rejects empty dhcp_bind_bridge
- veth mode fails when veth-wan-br link missing

Lifts diff coverage from 59.5% to 65.6%, meeting the 65% gate.

spinifex/services/vpcd/vpcd_test.go

@@ -324,6 +324,37 @@ func TestVerifyBridgeMode_EmptyModeRejected(t *testing.T) {
 	}
 }
 
+func TestVerifyBridgeMode_DirectMissingExternalIface(t *testing.T) {
+	err := verifyBridgeMode(BridgeModeDirect, "", "br-wan")
+	if err == nil || !strings.Contains(err.Error(), "external_interface") {
+		t.Fatalf("expected external_interface error, got: %v", err)
+	}
+}
+
+func TestVerifyBridgeMode_DirectMissingBindBridge(t *testing.T) {
+	err := verifyBridgeMode(BridgeModeDirect, "enp0s3", "")
+	if err == nil || !strings.Contains(err.Error(), "dhcp_bind_bridge") {
+		t.Fatalf("expected dhcp_bind_bridge error, got: %v", err)
+	}
+}
+
+func TestVerifyBridgeMode_VethMissingBindBridge(t *testing.T) {
+	err := verifyBridgeMode(BridgeModeVeth, "", "")
+	if err == nil || !strings.Contains(err.Error(), "dhcp_bind_bridge") {
+		t.Fatalf("expected dhcp_bind_bridge error, got: %v", err)
+	}
+}
+
+func TestVerifyBridgeMode_VethLinuxBrMissing(t *testing.T) {
+	stubBridgeProbes(t,
+		map[string]string{"veth-wan-ovs": OvnExternalBridge},
+		nil)
+	err := verifyBridgeMode(BridgeModeVeth, "", "br-wan")
+	if err == nil || !strings.Contains(err.Error(), "veth-wan-br") {
+		t.Fatalf("expected veth-wan-br error, got: %v", err)
+	}
+}
+
 // detectBridgeMode — mulga-998.b Fix 2.
 
 func stubDetectProbes(t *testing.T, macvlans []string, links []string) {