bundle: Section-G hardening (subset-rule bindings, Ceph public/cluster, raw amphora)

BUNDLEFIX-007: drop cinder loop block-device storage (Ceph-backed cinder; loop incompatible with LXD container placement)

bundle: dual provider+metal HA VIPs on API charms (BUNDLEFIX-006, D-020)

bundle: add memcached + nova-cc relation (BUNDLEFIX-004)

bundle: bind mysql-router subordinates to metal (BUNDLEFIX-005)

fix(bundle): cluster_count=1 on testcloud haclusters (BUNDLEFIX-003) ...

Single-unit principals can't reach the default 3-peer quorum; haclusters
blocked 'insufficient peers'. cluster_count=1 forms a 1-node cluster and
brings up the (public->provider, reachable) VIP. Matches the runtime
juju config already applied. Roosevelt's 3-unit bundle keeps the default.

fix(bundle): api-bindings minimal + de-HA vault for v1 (Option A) ...

- &api-bindings -> {":metal, public:provider}; drop 7 redundant metal keys
  that broke keystone/ceph-radosgw/openstack-dashboard at deploy
- vault: *internal-bindings, drop options(vip 10.12.4.236 provider / hostname),
  comment vault-hacluster + vault:ha. vault is metal-only single-unit on the
  testcloud; provider VIP unreachable from metal & pointless at 1 unit.
  HA restored at Roosevelt (3 units, metal VIP via NetBox).
Counts: VIPs 11->10, apps 51->50, relations 98->97.

bundle: remove Designate per D-019 (deferred to v2) ...

Removes the designate, designate-bind, designate-mysql-router,
               and designate-hacluster applications, plus all seven designate-
               related relations. Updates header comments to reflect the deferral.

               Rationale per D-019: v1 testcloud topology investigation confirmed
               outside-in DNS is not needed (corporate clients reach the cloud via
               the openstack.baldurkeep.com HTTPS proxy chain, not via *.cloud.
               neumatrix.local FQDNs). Tenant subnets use public DNS directly via
               --dns-nameserver. FIP DNS auto-registration is not load-bearing for
               any v1 acceptance criterion.

               VIP 10.12.4.227 becomes unused space in 10.12.4.224-.254 (same
               status as 10.12.4.225 reserved for v2 ceph-radosgw HA).

bundle: remove ceph-osd storage block to match expected-osd-count ...

The storage: block declared a second osd-devices entry (loop,1024M)
               which is additive to options.osd-devices per the charm config. That
               produced 8 OSDs against expected-osd-count: 4 on ceph-mon, with
               1 GB loopback OSDs as the asymmetric secondaries - a CRUSH-weighting
               anti-pattern.

               Real production storage (DB/WAL on actual SSDs) will be declared on
               Roosevelt. For the testcloud, BlueStore co-locates DB/WAL on the data
               device which is the documented default for single-device setups.

               osd-journals is unused under BlueStore.

Updates

Updates

Updated yaml and doc netbox ...

bundle: activate hacluster HA stack with API VIPs (workstream 2)

12 HA-eligible charms get VIPs from provider /22 range 10.12.4.224-.254
per D-003. ceph-radosgw HA deferred to v2 (.225 reserved).

Per-charm additions to options:
  barbican             vip 10.12.4.224  fqdn barbican.omega.dc0.vr0.cloud.neumatrix.local
  cinder               vip 10.12.4.226  fqdn cinder.omega.dc0.vr0...
  designate            vip 10.12.4.227  fqdn designate.omega.dc0.vr0...
  glance               vip 10.12.4.228  fqdn glance.omega.dc0.vr0...
  keystone             vip 10.12.4.229  fqdn keystone.omega.dc0.vr0...
  magnum               vip 10.12.4.230  fqdn magnum.omega.dc0.vr0...
  neutron-api          vip 10.12.4.231  fqdn neutron.omega.dc0.vr0...
  nova-cloud-controller vip 10.12.4.232 fqdn nova.omega.dc0.vr0...
  octavia              vip 10.12.4.233  fqdn octavia.omega.dc0.vr0...
  openstack-dashboard  vip 10.12.4.234  fqdn horizon.omega.dc0.vr0...
  placement            vip 10.12.4.235  fqdn placement.omega.dc0.vr0...
  vault                vip 10.12.4.236  fqdn vault.omega.dc0.vr0...

Structural fixes:
- vault, keystone, glance, placement: options: {} → options:
  (previous form would have failed YAML parse when vip was added)

Atomic uncomments:
- 12 hacluster subordinate apps (channel 2.4/stable per D-002)
- 12 :ha relations

v2-deferred (per workstream-2 decision):
- ceph-radosgw-hacluster app (commented)
- ceph-radosgw:ha relation (commented)
- 10.12.4.225 reserved as VIP slot for v2

NetBox VIP records queued post-deploy (engineer review on
ipv4-prefixes-import.py still pending). Tracked in
docs/netbox-vip-queue.md.

D-010 NetBox-upstream rule relaxed for v1 testcloud; will be
enforced for Roosevelt.

Updated bundle

Initial Upload