netplan: restore the Pi-identical comment; rollback re-runs van-br0-setup

- ap/50-van-wan.yaml: revert the comment to "see STARLINK_IFACE in deploy.conf" so the
  rendered file is byte-identical to the Pi 5's installed netplan (it otherwise reports
  "differs" forever); note in deploy.sh next to render_wan_netplan.
- check 14: baseline 3d117e7, keep byte-identity for wan.conf, assert no /etc/vanlink.conf;
  the failure branch no longer aborts the suite under pipefail.
- helper restore(): restart van-br0-setup (unit present, timeout 30, non-fatal) after the
  re-apply, before the connectivity re-check; asserted in the rollback sandbox scenario.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

ap/50-van-wan.yaml

@@ -10,7 +10,7 @@ network:
   version: 2
   ethernets:
     # Starlink dish uplink (RTL8153 USB NIC, MAC-named — travels with the
-    # adapter, see STARLINK_IFACE in /etc/vanlink.conf). The /32 link route keeps the
+    # adapter, see STARLINK_IFACE in deploy.conf). The /32 link route keeps the
     # dish's management address reachable no matter which WAN holds the
     # default route: the dish answers on 192.168.100.1 (gRPC :9200) even while
     # the uplink sits behind CGNAT.