netplan: restore the Pi-identical comment; rollback re-runs van-br0-setup

- ap/50-van-wan.yaml: revert the comment to "see STARLINK_IFACE in deploy.conf" so the
  rendered file is byte-identical to the Pi 5's installed netplan (it otherwise reports
  "differs" forever); note in deploy.sh next to render_wan_netplan.
- check 14: baseline 3d117e7, keep byte-identity for wan.conf, assert no /etc/vanlink.conf;
  the failure branch no longer aborts the suite under pipefail.
- helper restore(): restart van-br0-setup (unit present, timeout 30, non-fatal) after the
  re-apply, before the connectivity re-check; asserted in the rollback sandbox scenario.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

tests/check-templates.sh

@@ -207,12 +207,14 @@ done
 
 # 14. the netplan split leaves the Pi 5's rendered WAN netplan byte-identical, and the R5C (no Wi-Fi WAN) omits wifis
 old=$(mktemp)
-git show 223652b:ap/50-van-wan.yaml > "$old"
+# 3d117e7: the last commit with the original comments, byte-identical to what the Pi 5 has installed
+git show 3d117e7:ap/50-van-wan.yaml > "$old"
 want=$(VANLINK_CONF=hosts/wan.conf ./deploy.sh render "$old")
 tmpw=$(mktemp)
 # render_wan_netplan is internal; expose it through --render-wan-netplan (documented in the header)
 VANLINK_CONF=hosts/wan.conf ./deploy.sh --render-wan-netplan > "$tmpw"
-if [ "$want" = "$(cat "$tmpw")" ]; then ok "wan.conf: split netplan renders identical to the old single template"; else bad "wan.conf: netplan render changed by the split"; diff <(echo "$want") "$tmpw" | head -10 | sed 's/^/       /'; fi
+if [ "$want" = "$(cat "$tmpw")" ]; then ok "wan.conf: split netplan renders identical to the old single template"; else bad "wan.conf: netplan render changed by the split"; diff <(echo "$want") "$tmpw" | head -10 | sed 's/^/       /' || true; fi
+if grep -qF '/etc/vanlink.conf' "$tmpw"; then bad "wan.conf: rendered netplan mentions /etc/vanlink.conf (a comment was re-edited; live hosts would report differs)"; else ok "wan.conf: rendered netplan keeps the original comments (no /etc/vanlink.conf)"; fi
 if VANLINK_CONF=hosts/van.conf ./deploy.sh --render-wan-netplan | grep -q '^  wifis:'; then bad "van.conf: wifis stanza must be omitted (WIFI_WAN_IFACE empty)"; else ok "van.conf: no wifis stanza"; fi
 rm -f "$tmpw" "$old"
 
@@ -445,6 +447,10 @@ STUB
     a_is "stage2 dhcp-only default route: exit 1" "$rc" 1; a_is "stage2 dhcp-only default route: status" "$(st_word)" rolled-back
     grep -q '^ip route show default dev enP2p33s0 proto static$' "$sb/calls" && ok "apply helper stage2: checks van-failover's proto static route on the port" || bad "apply helper stage2: no proto static route check"
     grep -qF -- '--- diagnostics: stage 2' "$sb/log" && ok "apply helper stage2: diagnostics logged" || bad "apply helper stage2: diagnostics missing"
+    # rollback: van-br0-setup restarted after the re-apply (the 2nd netplan apply), before the connectivity re-check (last ping)
+    l_ap2=$(grep -n '^netplan apply' "$sb/calls" | sed -n 2p | cut -d: -f1 || true); l_br2=$(grep -n '^systemctl restart van-br0-setup$' "$sb/calls" | sed -n 2p | cut -d: -f1 || true)
+    l_pg=$(grep -n '^ping -c1 -W2 1.1.1.1$' "$sb/calls" | tail -1 | cut -d: -f1 || true)
+    [ -n "$l_ap2" ] && [ -n "$l_br2" ] && [ -n "$l_pg" ] && [ "$l_ap2" -lt "$l_br2" ] && [ "$l_br2" -lt "$l_pg" ] && ok "apply helper rollback: van-br0-setup restarted after the re-apply, before the connectivity re-check" || bad "apply helper rollback: van-br0-setup restart missing or misplaced (apply '$l_ap2', br0 '$l_br2', ping '$l_pg')"
     [ -e "$sb/netplan/10-dhcp-all-interfaces.yaml" ] && cmp -s "$sb/nmconf/zz-van-wan-pending.conf" "$sb/bak/nm-pending.conf" && ok "apply helper stage2: Armbian file and pending conf restored" || bad "apply helper stage2: Armbian file / pending conf not restored"
     rm -rf "$sb"
     # (5c) port absent: stage 2 needs no proto static route on it