Stage 5 dc0 redeploy: Path M teardown (clean) + ovn-central cert DELIVERY bug fixed ...

- Path M teardown of vr1-dc0 complete + clean: graceful drain (36->15) + juju
  resolved --no-retry (error-unit wedge, 15->3) + --force --no-wait (agents-stopped
  tail, 3->0). NO orphan (controller healthy), M.5 cascade clean (10 machines
  UNCHANGED, 9 Ready + 1 Deployed). Both --force and resolved operator-ruled (GA-R5).
- dc-node-etchosts.sh: render runcmd: -> postruncmd: -- juju model-config forbids a
  top-level runcmd in cloudinit-userdata. The 08-04 fix proved the CONCEPT live but
  never the DELIVERY (harness graded cloud-init YAML, which accepts runcmd, not juju
  acceptance). Harness switched to postruncmd + NEW T10 (juju-accepted key, rejects
  bare runcmd), MUTATION-PROVEN, 10/10. Step 1.2b now live-passing; re-staged to rack.
- M.6 rebuild to the deploy step: add-model (cred vr1-dc0-cred), spaces PASS 0 fatal,
  egress 8/8 PASS, dry-run PASS (9 machines, per-DC tags). Stage 5 remains OPEN.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728