fix(setup-ovn): declare Linux WAN bridge as NetDev so networkd-managed veth resolves Bridge= on reboot (mulga-siv-33)

The veth-mode reboot persistence drop-ins added in mulga-998.b were
incomplete: setup-ovn.sh wrote `15-spinifex-veth-wan.network` with
`Bridge=br-wan`, but never declared br-wan itself to networkd.

br-wan is created by `networking.service` (ifupdown via
`/etc/network/interfaces`, generated by `install.go writeNetworkConfig`),
not networkd. networkd's `Bridge=` directive requires the target to be a
known NetDev — when it isn't, networkd silently logs
`br-wan NetDev could not be found, ignoring assignment` and the veth
ends up with no master. vpcd's bridge-mode sanity check then fails on
every reboot.

Fix: also write `14-spinifex-br-wan.netdev` declaring br-wan as
`Kind=bridge`. networkd matches the existing kernel bridge by name+kind
(the `Failed to create netdev: File exists` log is harmless), and
`Bridge=br-wan` resolves on next boot. ifupdown still owns DHCP and the
IP — networkd just needs the NetDev declaration to enslave the veth.

The write is gated to avoid clobbering operator-managed networkd config:
if any other `.netdev` under `/etc/systemd/network`,
`/run/systemd/network`, or `/usr/lib/systemd/network` already declares
the WAN bridge by name, the write is skipped with a log line pointing
at the operator file. Cleanup hook also removes the new file when
switching away from veth mode.

Verified end-to-end via QEMU repro: clean install + first boot + reboot,
veth-wan-br master persists across reboots, vpcd starts cleanly.

scripts/setup-ovn.sh

@@ -301,7 +301,8 @@ if [ -n "$WAN_BRIDGE" ]; then
     # veth pair re-materialises on reboot and fights the current mode's
     # bridge plumbing (Fix 1, mulga-998.b, per D17).
     if [ "$WAN_BRIDGE_MODE" != "veth" ]; then
-        sudo rm -f /etc/systemd/network/15-spinifex-veth-wan.netdev \
+        sudo rm -f /etc/systemd/network/14-spinifex-br-wan.netdev \
+                   /etc/systemd/network/15-spinifex-veth-wan.netdev \
                    /etc/systemd/network/15-spinifex-veth-wan.network \
                    /etc/systemd/network/16-spinifex-veth-wan-ovs.network
         sudo networkctl reload 2>/dev/null || true
@@ -366,9 +367,37 @@ if [ -n "$WAN_BRIDGE" ]; then
             # are kernel-only and vanish on reboot; without persistence vpcd
             # starts with the OVS port pointing at a nonexistent peer and
             # silently falls back to direct mode (Fix 1, mulga-998.b).
+            #
+            # Declare the Linux bridge as a NetDev too (even though it's
+            # already created by ifupdown) so networkd recognises it and the
+            # `Bridge=$LINUX_BRIDGE` directive below resolves. Without this,
+            # networkd logs `br-wan NetDev could not be found, ignoring
+            # assignment` and veth-wan-br ends up orphaned with no master,
+            # which crashes vpcd's veth bridge mode sanity check on reboot.
+            # `Failed to create netdev: File exists` is harmless — networkd
+            # then matches the existing kernel bridge by name+kind.
+            #
+            # Gate: skip the write if any operator-managed .netdev (cloud-init,
+            # netplan, manual op) already declares this bridge — don't clobber
+            # custom networkd config. networkd searches /etc, /run, /usr/lib in
+            # that priority order; check all three. Our own file is excluded so
+            # idempotent re-runs still rewrite when needed.
+            BR_WAN_NETDEV="/etc/systemd/network/14-spinifex-br-wan.netdev"
             VETH_NETDEV="/etc/systemd/network/15-spinifex-veth-wan.netdev"
             VETH_NETWORK="/etc/systemd/network/15-spinifex-veth-wan.network"
             VETH_OVS_NETWORK="/etc/systemd/network/16-spinifex-veth-wan-ovs.network"
+            EXISTING_BR_NETDEV=$(grep -rls --include="*.netdev" -E "^\s*Name=$LINUX_BRIDGE\s*$" \
+                /etc/systemd/network /run/systemd/network /usr/lib/systemd/network 2>/dev/null \
+                | grep -v "^$BR_WAN_NETDEV$" || true)
+            if [ -n "$EXISTING_BR_NETDEV" ]; then
+                echo "  skipping $BR_WAN_NETDEV — operator-managed NetDev already declares $LINUX_BRIDGE: $EXISTING_BR_NETDEV"
+            else
+                sudo tee "$BR_WAN_NETDEV" >/dev/null <<NETDEV
+[NetDev]
+Name=$LINUX_BRIDGE
+Kind=bridge
+NETDEV
+            fi
             sudo tee "$VETH_NETDEV" >/dev/null <<NETDEV
 [NetDev]
 Name=veth-wan-br