deploy --diff: cover plain install files and removals

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KqhjP7nud5gdBg25zCiRk9

deploy.sh

@@ -117,6 +117,19 @@ case "${1:-}" in
                 diff -u "$dst" <(render "$src") | sed 's/^/    /' || true
             fi
         done
+        # Also lists plain `install` files and `rm -f` targets — these sections may be
+        # flag-gated in the real run, but --diff reports them regardless of the flag.
+        grep -E '^[[:space:]]*install -D -m[0-9]+ +[^" ]+ +/' deploy.sh | while read -r _ _ _ src dst _; do
+            if [ ! -e "$dst" ]; then
+                echo "NEW      $dst"
+            elif ! cmp -s "$src" "$dst"; then
+                echo "CHANGED  $dst"
+                diff -u "$dst" "$src" | sed 's/^/    /' || true
+            fi
+        done
+        grep -E '^[[:space:]]*rm -f +/' deploy.sh | while read -r _ _ path _; do
+            [ -e "$path" ] && echo "REMOVE   $path"
+        done || true
         exit 0 ;;
     render)
         [ -n "${2:-}" ] || { echo "Usage: $0 render <file>"; exit 1; }
@@ -231,9 +244,11 @@ install_rendered ap/21-van-br0.network      /etc/systemd/network/21-van-br0.netw
 install_rendered ap/22-van-lan.network      /etc/systemd/network/05-van-lan.network
 rm -f /etc/systemd/network/22-van-lan.network
 if [ -n "${ONBOARD_LAN_IFACE:-}" ]; then
-    install_rendered ap/23-van-lan-eth0.network /etc/systemd/network/23-van-lan-eth0.network
-else
+    # 06- sorts before netplan's 10-* catch-all, like 05-van-lan above
+    install_rendered ap/23-van-lan-eth0.network /etc/systemd/network/06-van-lan-eth0.network
     rm -f /etc/systemd/network/23-van-lan-eth0.network
+else
+    rm -f /etc/systemd/network/23-van-lan-eth0.network /etc/systemd/network/06-van-lan-eth0.network
 fi
 install_rendered ap/van-ap-unmanaged.conf   /etc/NetworkManager/conf.d/van-ap-unmanaged.conf
 # Mask dracut's initramfs-generated catch-all (/run/systemd/network/
@@ -484,6 +499,12 @@ networkctl reload 2>/dev/null || true
 
 write_warnings
 
+if [ ${#WARNINGS[@]} -gt 0 ]; then
+    echo
+    echo "== warnings =="
+    for w in "${WARNINGS[@]}"; do echo "   -> $w"; done
+fi
+
 echo
 echo "Deployed. NOTE: until the USB hub (AP radios + LAN/Starlink adapters) is"
 echo "plugged in, hostapd/hostapd-2g just retry every 5s — that is by design."