Docs: shared checkout model, /etc/vanlink.conf references

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

deploy.sh

@@ -1,9 +1,11 @@
 #!/usr/bin/env bash
-# Deploy vanlink configs/scripts (Pi 4 "wan" port) to their system locations.
+# Deploy vanlink configs/scripts to their system locations. One checkout is
+# shared by every host; host-specific values come from /etc/vanlink.conf
+# (symlink to hosts/<hostname>.conf — see hosts/vanlink.conf.example).
 # Usage:  cd ~/vanlink && sudo ./deploy.sh
-#         sudo ./deploy.sh render <file>   # preview a templated file on stdout
-#         ./deploy.sh --check [conf]        # validate conf + render all templates (no root)
-#         ./deploy.sh --templates           # list templated files
+#         ./deploy.sh --check [conf]       # validate conf + render all templates, no install
+#         ./deploy.sh --diff [conf]        # what would change in /etc
+#         ./deploy.sh render <file>        # preview a templated file on stdout
 # Idempotent. Netplan (wlan0 + Starlink NIC = NM-managed WANs; eth0 is a LAN
 # port on br0) is NOT deployed here — reference copy in ap/50-van-wan.yaml,
 # applied once manually (apply flaps uplinks). We do check it for drift below.
@@ -252,7 +254,7 @@ echo "== dns =="
 # Disable systemd-resolved DNS listener — dnsmasq handles DNS+DHCP on bridge.
 # Even localhost-only listening blocks dnsmasq from binding to port 53.
 install -D -m0644 ap/systemd-resolved-disable.conf /etc/systemd/system/systemd-resolved.service.d/disable.conf
-# Fixed upstream resolvers (deploy.conf's DNS_RESOLVERS), never a WAN's own
+# Fixed upstream resolvers (/etc/vanlink.conf's DNS_RESOLVERS), never a WAN's own
 # DHCP/RA-provided DNS — see the files themselves for the full rationale.
 # (NM's ipv4/ipv6.ignore-auto-dns can't be set as a config-file connection
 # default — NM rejects it there — so 60-van-wan-dns enforces this directly