Stage 5 dc0 redeploy: Path M teardown (clean) + ovn-central cert DELIVERY bug fixed ...

- Path M teardown of vr1-dc0 complete + clean: graceful drain (36->15) + juju
  resolved --no-retry (error-unit wedge, 15->3) + --force --no-wait (agents-stopped
  tail, 3->0). NO orphan (controller healthy), M.5 cascade clean (10 machines
  UNCHANGED, 9 Ready + 1 Deployed). Both --force and resolved operator-ruled (GA-R5).
- dc-node-etchosts.sh: render runcmd: -> postruncmd: -- juju model-config forbids a
  top-level runcmd in cloudinit-userdata. The 08-04 fix proved the CONCEPT live but
  never the DELIVERY (harness graded cloud-init YAML, which accepts runcmd, not juju
  acceptance). Harness switched to postruncmd + NEW T10 (juju-accepted key, rejects
  bare runcmd), MUTATION-PROVEN, 10/10. Step 1.2b now live-passing; re-staged to rack.
- M.6 rebuild to the deploy step: add-model (cred vr1-dc0-cred), spaces PASS 0 fatal,
  egress 8/8 PASS, dry-run PASS (9 machines, per-DC tags). Stage 5 remains OPEN.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

ovn-central cert: root-caused, fix PROVEN live, and wired for redeploy ...

Root cause (measured, corrects the committed rdns_mode/binding framing):
charm-ovn-central derives its TLS common_name from get_hostname(its
metal-internal address); that plane is deliberately isolated (D-052) with no
reachable resolver, so the reverse lookup returns None -> empty CN -> vault
issues no server cert -> OVN cluster never forms. rdns_mode=2 and the PTR
exist; only the reverse is unreachable from the isolated plane.

Binding approach REFUTED live (3 configs): the charm uses the metal-internal
address regardless of which endpoint is rebound, and juju default-route
selection is not tied to the default binding. So the app STAYS on
metal-internal (D-052-correct for its OVSDB/certificates data type).

Fix PROVEN end-to-end (controlled single-unit test): an /etc/hosts reverse
entry -> CN populated -> vault issued ovn-central_0.server.cert ->
/etc/ovn/{cert_host,key_host,ovn-central.crt} written; control units without
it stayed broken. OVN imposes no CN-content rule; vault signs any non-empty CN.

Wired (verify-at-provision on the redeploy):
- NEW scripts/dc-node-etchosts.sh + tests/dc-node-etchosts (harness 9/9):
  renders a per-DC cloudinit-userdata adding each node's metal-internal
  address -> hostname to /etc/hosts at provision; CIDR derived from lib-net
  (dc0 10.12.12.0/22, dc1 10.12.72.0/22). Rendered runcmd executed live and
  correctly scoped to metal-internal.
- runbooks/phase-01-bundle-deploy.md Step 1.2b: gated pre-deploy step
  (after add-model, before deploy), VR1-only.
- A NEW mechanism borrowing D-008's shape, not D-008 itself.

Records: reeval RESOLUTION + CURRENT-STATE RESOLVED+WIRED + changelog; the old
rdns_mode remediation is VOID. Gauntlet ALL GREEN (99), repo-lint 0 fail.
Live tests were reversible; model left at its captured before-state.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf