fix(profiles): remove site-specific and no-op values from embedded profiles #90

Context

Audit of the embedded profiles on 2026-11-09.

• verified: internal/config/profiles/dgx.yaml:22-25 hard-codes cloudflared.private_network.interface and a fixed /32 address since the initial commit. Every host that applies dgx claims the same address.
• verified: gpu-server.yaml sets private_network.enabled: true with an empty address; every code path requires a non-empty address (cloudflared.go:178,218), so it does nothing.
• inferred: full.yaml repeats keys minimal already sets and enables network without ufw: true, which makes the network module a no-op (network.go:76). allowed_ports: [22] repeats what requiredPorts always adds.
• verified: README's profile table omits rocky, says minimal adds "ufw" (it installs the package but does not enable the network module), and omits dgx's /raid/home, GPU allocation and UFW.

Implementation starts only on the owner's go-ahead.

Decisions

• Site-specific values (addresses, interfaces) never live in embedded profiles; they go in a site config that extends a profile.
• private_network.enabled: true with an empty address becomes a validation error with a message naming the key to set.

• 2026-11-09: remove the dgx VLAN address from the profile now (no deprecation release); release notes carry the Action needed step for DGX hosts. Basis: owner decision in the planning session.

Design

• Drop private_network from dgx.yaml and gpu-server.yaml; keep cloudflared.enabled.
• Remove duplicate and no-op keys from full.yaml, dgx.yaml, gpu-server.yaml; decide whether full means UFW on (ufw: true) or drop network from it.
• config.Validate(): error on enabled private network without address.
• First check what apply does to an existing VLAN when the profile stops declaring it (must not tear it down silently); record the result in the issue.

Changes

• internal/config/profiles/{dgx,gpu-server,full}.yaml, internal/config/validate.go (+ test), README.md profile table, docs/fleet.example.yaml (site-config example with private_network), release notes ### Action needed.

Acceptance criteria

• AC1: no embedded profile contains an IP address (grep -E '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' internal/config/profiles is empty).
• AC2: rootfiles config validate rejects private_network.enabled: true without address, naming the key.
• AC3: each profile's effective config (config show --profile X) differs from before only by the removed keys; a golden test pins it.
• AC4: README profile table matches the YAML, including rocky.
• AC5: release notes carry the Action needed step for DGX hosts.

Tasks

• T1: confirm existing-VLAN behaviour on profile removal (read cloudflared Check/Apply), note it here
• T2: profile edits + golden test (AC1, AC3)
• T3: validation (AC2)
• T4: README table, example site config, release note (AC4, AC5)

Out of scope

• New profiles.