apply ovn-central default -> metal-internal in bundle; WITHDRAW dashboard fix (D-072) ...

Applied the ruled ovn-central fix to bundle.yaml: '' default metal-admin ->
metal-internal, with an explanatory comment citing LP #2044324 and the D-052
amendment. provider-bundle-check PASS, repo-lint 0 fail.

WITHDRAWN: the openstack-dashboard:cluster fix. On reading bundle.yaml:667 before
applying, found it is D-072 / BUNDLEFIX-011 -- a RULED, as-executed fix: horizon
renders haproxy's 443 backend on the cluster-binding address but only creates
apache SSL vhosts for the default+public addresses, so cluster on metal-internal
= dashboard VIP HTTPS dead (L4 check masks it). metal-admin is deliberate.
Reverting it would reintroduce the exact bug D-072 repaired.

OWNED: my sweep flagged it because it compared binding VALUES against generic
D-052 plane purposes without grepping the governing D-NNN -- which CLAUDE.md
explicitly requires before touching a built surface. The in-bundle comment was
right above the line. Caught by reading the bundle before applying, not by the
sweep. Sweep audit, D-052 amendment, and CURRENT-STATE all corrected: 1 real
deviation (ovn-central), 5 non-issues.

Dashboard binding UNCHANGED. Next: re-stage bundle + live juju bind ovn-central.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf

D-052 amendment: ovn-central default -> metal-internal (ruled); bundle plane-purpose sweep ...

Operator ruling, exact utterance: 'ovn-central should be in metal-internal.'
Follow-on: 'Complete a bundle sweep for any other bindings that are bound to a
plane that does not match the planes intended purpose.'

ovn-central's '' default binding moves metal-admin -> metal-internal. Its
certificates + ovsdb* endpoints already live on metal-internal; moving the
default makes it single-space for cert resolution, dodging LP #2044324 (the
multi-space ovn-central cert bug this deploy hit). D-052 isolation unchanged for
every other app.

Bundle plane-purpose sweep (all 56 apps, capture
binding-plane-purpose-sweep-20260803.txt): classified every binding against
D-052's plane purposes, verified each flag against the relation topology. Exactly
ONE other real deviation: openstack-dashboard:cluster on metal-admin where D-052
places cluster peers on metal-internal (sole outlier of 14 cluster-carrying apps;
benign but off-intent) -- PROPOSED, not ruled. Four flags verified non-issues:
octavia:ovsdb-cms is dangling (no relation); ceph-radosgw public/object-store/
cluster are gateway endpoints correctly placed.

Not yet applied -- bundle edit + live juju bind are the next gated step.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf