fix(galactic): finish Turin PodCIDR migration

[gregkonush]

Summary

• Complete Turin's transition to a /23 PodCIDR by raising its durable kubelet cap to 500. Keep Altra at 250 until its own migration.
• Make the guarded CNI helper work on physical Talos: read the hostname in PID 1's UTS namespace and query actual CNI bridge membership with ip link. Physical NICs exposing VEB mode are not CNI bridge ports.
• Preserve all host, boot-ID, sandbox ownership, lease, and retry gates. Record the accepted service downtime and restoration requirements.

Related Issues

None

Testing

• Python PodCIDR suite: 35 tests passed, including physical-host identity, namespace restoration, physical NIC bridge-mode regression, attached-port refusal, and retry safety.
• bun test devices/galactic/omni/render-template.test.ts: 7 tests passed.
• Ruff lint/format, Oxfmt, Oxlint for the changed TypeScript test, and git diff --check: passed.
• Omni render, template validation, and dry-run: only Turin's machine patch changes, from maxPods: 250 to 500.
• Live Turin acquired 10.244.0.0/23 with a new Node UID and the original host boot ID and etcd member ID. Exact-plan cleanup completed; both CNI links and seven obsolete lease records were archived/removed as intended.
• DNS, Service routing, and 288 KiB HTTP transfers passed in both directions between Turin and Altra. All CNPG clusters recovered; Ceph returned to HEALTH_OK with all six original OSDs up/in and clean PGs. Temporary maintenance controls were restored.
• The 500-pod setting will be applied through Omni after this merge; capacity, GPU, Kata, and runner acceptance are recorded in the operational evidence.

Breaking Changes

None. Altra's live /24 remains capped at 250.

Checklist

• Testing section documents the exact validation performed.
• Screenshots and Breaking Changes sections are handled appropriately.
• Documentation, release notes, and follow-ups are updated or tracked.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T03:23:07.130670Z	729ff49	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[gregkonush]

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 774608bac3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 729ff49242

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update the remaining runbook steps for migrated Turin

After these lines mark Turin as migrated to /23 with a durable 500-pod cap, the same runbook still describes Turin as /24/250 at lines 9-22, directs every target to run the non-migrated preflight at line 124, and claims the durable template still caps the node at 250 at line 189. podcidr_preflight.py:63-69 makes that command expect exactly 250 pods unless --migrated is supplied, so following the documented Turin path after this change produces a failing gate and misleading restoration steps. The Omni README was corrected, but this operational runbook also needs target-aware/current instructions.

AGENTS.md reference: AGENTS.md:L57-L58

Useful? React with 👍 / 👎.