Add router-on-a-stick, commit-confirm rollback and an example config

- Allow the WAN link to also carry LANs when the uplink is PPPoE on a
  VLAN with IPv6 off; only the PPP device counts as an uplink then, so
  LAN traffic can never match WAN rules.
- Add router.rollback: router-arm / router-confirm / router-rollback
  plus `nix run .#deploy`, a commit-confirm deployment flow.
- Wait for the LAN devices instead of the uplink in networkd
  wait-online, so an unplugged uplink cannot block boot or activation.
- Add examples/desktop (single NIC, PPPoE on VLAN 1001) as
  nixosConfigurations.example, built as a flake check.

Covered by the onestick and rollback VM tests and new assertion cases.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

flake.nix

@@ -3,9 +3,13 @@
 
   inputs.nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
 
-  outputs = { self, nixpkgs }:
+  outputs =
+    { self, nixpkgs }:
     let
-      systems = [ "x86_64-linux" "aarch64-linux" ];
+      systems = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
       forAllSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
     in
     {
@@ -14,12 +18,46 @@
         default = self.nixosModules.router;
       };
 
-      # VM tests need KVM; only wired up for x86_64 until aarch64 CI exists.
-      checks.x86_64-linux = import ./tests {
-        inherit self;
-        pkgs = nixpkgs.legacyPackages.x86_64-linux;
+      # A deployable starting point; copy examples/desktop and adapt it.
+      nixosConfigurations.example = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          self.nixosModules.router
+          ./examples/desktop
+        ];
       };
 
+      # `nix run .#deploy -- <flake-attr> <user@host>`: activate a new
+      # configuration with commit-confirm; see scripts/deploy.sh.
+      apps.x86_64-linux.deploy =
+        let
+          pkgs = nixpkgs.legacyPackages.x86_64-linux;
+          deploy = pkgs.writeShellApplication {
+            name = "router-deploy";
+            runtimeInputs = with pkgs; [
+              nixos-rebuild
+              openssh
+              coreutils
+            ];
+            text = builtins.readFile ./scripts/deploy.sh;
+          };
+        in
+        {
+          type = "app";
+          program = "${deploy}/bin/router-deploy";
+        };
+
+      # VM tests need KVM; only wired up for x86_64 until aarch64 CI exists.
+      checks.x86_64-linux =
+        import ./tests {
+          inherit self;
+          pkgs = nixpkgs.legacyPackages.x86_64-linux;
+        }
+        // {
+          # The example must keep building as a complete system.
+          example = self.nixosConfigurations.example.config.system.build.toplevel;
+        };
+
       # `nix run .#lab`: boot the basic test topology in tmux, one console pane
       # per VM plus the interactive test-driver REPL.
       apps.x86_64-linux.lab =
@@ -28,7 +66,12 @@
           test = self.checks.x86_64-linux.basic;
           lab = pkgs.writeShellApplication {
             name = "router-lab";
-            runtimeInputs = with pkgs; [ tmux util-linux gnugrep coreutils ];
+            runtimeInputs = with pkgs; [
+              tmux
+              util-linux
+              gnugrep
+              coreutils
+            ];
             text = import ./tests/lab.nix {
               inherit (pkgs) lib;
               driver = test.driverInteractive;