fix(ipsec): use Debian unit name openvswitch-ipsec.service

CI artifact shows `Unit ovs-monitor-ipsec.service could not be found`
on every node. Debian's openvswitch-ipsec package ships the unit as
openvswitch-ipsec.service (the binary inside is ovs-monitor-ipsec, but
systemd's name follows the package). The previous commit guarded on
the wrong unit name, so:

- spinifex-daemon.service Wants=/After= silently no-op'd (missing unit)
- enableOVNIPSec's `systemctl enable --now ovs-monitor-ipsec.service`
  failed, daemon logged a warning and continued without flipping
  ipsec_encapsulation=true
- TestMultinodeIPSec skipped with `node1 reports ""` because OVS DB
  never received the cert pointers

Rename across all 5 spots (daemon, systemd unit, test, CI diag script,
workflow journal capture) to match the Debian package layout.

Note: the package itself still must be present on the CI VM image —
that's tracked in the mulga repo (image-builder provision.sh +
bootstrap-install.sh shim).

Refs: mulga-siv-136

.github/scripts/capture-net-diag.sh

@@ -6,8 +6,8 @@
 # binary on one path doesn't abort the rest of the capture.
 #
 # Output layout (under $1/net-diag/):
-#   ovs-monitor-ipsec.status         systemctl status (output-only)
-#   ovs-monitor-ipsec.journal        last 200 journal lines
+#   openvswitch-ipsec.status         systemctl status (output-only)
+#   openvswitch-ipsec.journal        last 200 journal lines
 #   ipsec.openvswitch_conf           ovs-vsctl get Open_vSwitch . other_config
 #   ipsec.xfrm_state                 ip xfrm state list
 #   ipsec.xfrm_policy                ip xfrm policy list
@@ -32,8 +32,8 @@ run() {
     } > "$OUT/$label" || true
 }
 
-run ovs-monitor-ipsec.status            sudo systemctl status ovs-monitor-ipsec.service --no-pager --full --lines=50
-run ovs-monitor-ipsec.journal           sudo journalctl -u ovs-monitor-ipsec.service --no-pager --output=short-iso -n 200
+run openvswitch-ipsec.status            sudo systemctl status openvswitch-ipsec.service --no-pager --full --lines=50
+run openvswitch-ipsec.journal           sudo journalctl -u openvswitch-ipsec.service --no-pager --output=short-iso -n 200
 run ipsec.openvswitch_conf              sudo ovs-vsctl get Open_vSwitch . other_config
 run ipsec.xfrm_state                    sudo ip xfrm state list
 run ipsec.xfrm_policy                   sudo ip xfrm policy list

.github/workflows/e2e-go.yml

@@ -728,12 +728,14 @@ jobs:
               > "${ARTIFACT_DIR}/spinifex-journal-node${idx}.log" 2>/dev/null
             ok "journal node${idx}: $(wc -l < "${ARTIFACT_DIR}/spinifex-journal-node${idx}.log" 2>/dev/null || echo 0) lines"
           done
-          # ovs-monitor-ipsec journal per node (separate file — bead 136).
+          # openvswitch-ipsec journal per node (separate file — bead 136).
+          # Debian unit name; the binary inside is /usr/share/openvswitch/scripts/ovs-ctl
+          # which spawns ovs-monitor-ipsec as a child.
           for i in "${!NODE_LIST[@]}"; do
             idx=$((i + 1))
             ip="${NODE_LIST[$i]}"
-            ssh "${SSH_OPTS[@]}" tf-user@"$ip" 'sudo journalctl -u ovs-monitor-ipsec.service --no-pager --output=short-iso --since "60 min ago"' \
-              > "${ARTIFACT_DIR}/ovs-monitor-ipsec-node${idx}.log" 2>/dev/null
+            ssh "${SSH_OPTS[@]}" tf-user@"$ip" 'sudo journalctl -u openvswitch-ipsec.service --no-pager --output=short-iso --since "60 min ago"' \
+              > "${ARTIFACT_DIR}/openvswitch-ipsec-node${idx}.log" 2>/dev/null
           done
 
       - name: Convert test logs to JUnit XML