apply-network fix round 1: reload networkd after the NM reload on rollback; harden post-check tests

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

deploy.sh

@@ -390,7 +390,7 @@ PY
         #     configured/configuring holds a stale in-memory claim (cured by networkctl reload).
         #     Before the apply networkd legitimately owns it: say nothing.
         if [ "$f" = matches ] && [ -e "$sysnet/$STARLINK_IFACE" ] && command -v networkctl >/dev/null 2>&1; then
-            out=$(networkctl --no-pager --no-legend list 2>/dev/null | awk -v i="$STARLINK_IFACE" '$2 == i { print $5; exit }') || out=
+            out=$(networkctl --no-pager --no-legend list 2>/dev/null | awk -v i="$STARLINK_IFACE" '$2 == i { s = $5 } END { print s }')
             case "$out" in
                 configured|configuring) warn "post-deploy: networkd still manages $STARLINK_IFACE although NetworkManager owns it — run: networkctl reload" ;;
                 unmanaged) echo "   ok    networkd leaves $STARLINK_IFACE to NetworkManager" ;;
@@ -545,8 +545,8 @@ restore() {  # restore <reason>: put the pre-run netplan back, re-check connecti
         [ ! -f "\$nd/10-dhcp-all-interfaces.yaml.vanlink-disabled" ] || mv "\$nd/10-dhcp-all-interfaces.yaml.vanlink-disabled" "\$nd/10-dhcp-all-interfaces.yaml"
     fi
     timeout -k $AN_KILL_T $AN_GEN_T netplan generate && timeout -k $AN_KILL_T $AN_APPLY_T netplan apply || { [ "\$rb" != ok ] || rb=APPLY-FAILED; }
-    nd_reload   # the old config is back: networkd's in-memory state changes the other way
     [ ! -f "\$ncd/$pc" ] || timeout $AN_NM_T nmcli general reload conf || echo "nmcli general reload conf failed"
+    nd_reload   # NM has let go of the port; now networkd, with the old config back, claims it (after the NM reload, not before)
     # the re-apply restarted networkd too, which can drop br0's members (as on the forward path; not gating)
     if timeout $AN_NM_T systemctl cat van-br0-setup >/dev/null 2>&1; then
         timeout $AN_RESTART_T systemctl restart van-br0-setup || echo "van-br0-setup restart failed (continuing)"