netplan: restore the Pi-identical comment; rollback re-runs van-br0-setup

- ap/50-van-wan.yaml: revert the comment to "see STARLINK_IFACE in deploy.conf" so the
  rendered file is byte-identical to the Pi 5's installed netplan (it otherwise reports
  "differs" forever); note in deploy.sh next to render_wan_netplan.
- check 14: baseline 3d117e7, keep byte-identity for wan.conf, assert no /etc/vanlink.conf;
  the failure branch no longer aborts the suite under pipefail.
- helper restore(): restart van-br0-setup (unit present, timeout 30, non-fatal) after the
  re-apply, before the connectivity re-check; asserted in the rollback sandbox scenario.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

deploy.sh

@@ -106,6 +106,9 @@ render() {  # render <file> -> stdout, with @TOKEN@ placeholders substituted
 # The netplan is two templates: ap/50-van-wan.yaml (ethernet/Starlink) and
 # ap/50-van-wan-wifi.yaml (the wifis: stanza, appended verbatim only for hosts
 # with a Wi-Fi uplink, so a host without one gets no empty/invalid wifis: block).
+# The rendered netplan must stay byte-identical to what live hosts have installed (comments included:
+# nm_wan_state_netplan compares bytes, and "differs" invites an --apply-network that flaps the uplinks).
+# Do not edit comments in ap/50-van-wan*.yaml without re-checking `--wan-plan` on every host.
 render_wan_netplan() {  # ap/50-van-wan.yaml, plus the wifis stanza when the host has a Wi-Fi uplink
     render ap/50-van-wan.yaml
     if [ -n "${WIFI_WAN_IFACE:-}" ]; then
@@ -401,7 +404,7 @@ PY
 #   (netplan generate/apply run under timeout -k AN_KILL_T: +AN_KILL_T each in the worst case)
 #   forward path  AN_FWD = NM conf reload + generate + apply + 2*kill + van-br0-setup (unit check + restart)
 #                          + stage 1 + restart + stage 2 + networkd info line + diagnostics (logged once, on a failed gate)
-#   rollback path AN_RB  = generate + apply + 2*kill + NM conf reload + restart + connectivity recheck
+#   rollback path AN_RB  = generate + apply + 2*kill + NM conf reload + van-br0-setup (unit check + restart) + restart + connectivity recheck
 #   helper worst case AN_HELPER_MAX = AN_FWD + AN_RB + AN_SLOP (loop iterations overshoot their
 #     deadline by a few nmcli/ping timeouts)
 #   foreground waits AN_WAIT = AN_HELPER_MAX + 30
@@ -413,7 +416,7 @@ PY
 AN_KILL_T=10 AN_APPLY_T=90 AN_GEN_T=30 AN_NM_T=5 AN_RESTART_T=30 AN_S1=60 AN_S2=120 AN_RC=60 AN_SLOP=60
 AN_DIAG=$(( 5 * AN_NM_T ))   # diag(): five commands, each under timeout AN_NM_T
 AN_FWD=$(( AN_NM_T + AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_RESTART_T + AN_S1 + AN_RESTART_T + AN_S2 + AN_NM_T + AN_DIAG ))
-AN_RB=$(( AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_RESTART_T + AN_RC ))
+AN_RB=$(( AN_GEN_T + AN_APPLY_T + 2 * AN_KILL_T + AN_NM_T + AN_NM_T + AN_RESTART_T + AN_RESTART_T + AN_RC ))
 AN_HELPER_MAX=$(( AN_FWD + AN_RB + AN_SLOP ))
 AN_WAIT=$(( AN_HELPER_MAX + 30 ))
 AN_RUNMAX=$(( AN_HELPER_MAX + 60 ))
@@ -517,6 +520,10 @@ restore() {  # restore <reason>: put the pre-run netplan back, re-check connecti
     fi
     timeout -k $AN_KILL_T $AN_GEN_T netplan generate && timeout -k $AN_KILL_T $AN_APPLY_T netplan apply || { [ "\$rb" != ok ] || rb=APPLY-FAILED; }
     [ ! -f "\$ncd/$pc" ] || timeout $AN_NM_T nmcli general reload conf || echo "nmcli general reload conf failed"
+    # the re-apply restarted networkd too, which can drop br0's members (as on the forward path; not gating)
+    if timeout $AN_NM_T systemctl cat van-br0-setup >/dev/null 2>&1; then
+        timeout $AN_RESTART_T systemctl restart van-br0-setup || echo "van-br0-setup restart failed (continuing)"
+    fi
     timeout $AN_RESTART_T systemctl restart van-failover || true
     end=\$((SECONDS+$d3))
     while :; do