warm: self-heal wedged dnsmasq, run after deploy, shared state dir

dnsmasq adds IPs to an nft set only on a fresh upstream reply; a cache
hit never refreshes the set. On Archie the :5350 instance also wedged:
TCP child processes first, then the main process, logged
'nftset ... netlink: Error: cache initialization failed: Protocol error'
on every add and stopped filling bbrkn_v4/v6 until restarted.

warm-nftset.sh now counts those errors for the main PID during the run
(journalctl _PID=) and, if any, restarts the service and warms again;
exit 1 if it still fails. The state dir defaults to /var/lib/bbrkn so the
root cron job and the deploy share one lock (LOCK_WAIT lets deploy wait).

deploy-to-gateway.sh runs the warmer right after flushing the sets,
since clients keep old IPs cached and would bypass the tunnel until the
next fresh resolve. A warm failure only warns; it does not roll back.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DR7zpSsdX28T4Kn6v4jPSS

scripts/deploy-to-gateway.sh

@@ -232,6 +232,23 @@ else
   fi
 fi
 
+# ==============================
+# Прогрев nft-сетов: после flush сеты пусты, а у клиентов в кэше (Edge,
+# Windows) остаются старые IP — без прогрева их трафик идёт мимо туннеля до
+# первого свежего резолва. Ошибка прогрева деплой не откатывает: конфиги уже
+# проверены, а cron-прогрев повторит попытку.
+# ==============================
+WARM_SCRIPT="${WARM_SCRIPT:-$(dirname "$0")/warm-nftset.sh}"
+if [ -f "$WARM_SCRIPT" ]; then
+  echo "Warming nft sets ($WARM_SCRIPT)..."
+  if ! NFTSET_CONF="$nftset_dest" HOST_DNSMASQ_SVC="$HOST_DNSMASQ_SVC" \
+       LOCK_WAIT="${WARM_LOCK_WAIT:-300}" bash "$WARM_SCRIPT"; then
+    echo "  WARN: warm failed — sets will refill on client queries / hourly cron"
+  fi
+else
+  echo "  WARN: $WARM_SCRIPT not found, skipping warm"
+fi
+
 echo "Deployment completed successfully"
 DOMAIN_COUNT=$(grep -c '^nftset=' "$nftset_dest" || echo "0")
 echo "Applied nftset configuration for $DOMAIN_COUNT domain directives"