bootstrap.sh: accept LAN reachability as a mesh-equivalent

LXCs without a mesh CLI sit on 192.168.8.0/24 which is in the
issuance service's MESH_SUBNETS — they should be able to bootstrap
without netbird/tailscale installed. New third path probes the
issuance /health endpoint directly; if reachable, treat that as
satisfying the mesh precondition.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bootstrap.sh

@@ -142,16 +142,21 @@ if [ "${#missing[@]}" -gt 0 ]; then
     exit 1
 fi
 
-# Mesh check — accept either Netbird OR Tailscale.
+# Mesh check — accept Netbird, Tailscale, or LAN reachability of the issuance
+# endpoint. LAN is fine for LXCs that don't run a mesh CLI but sit in the
+# trusted subnet (192.168.8.0/24) included in MESH_SUBNETS.
 MESH_CONNECTED=""
 if command -v netbird >/dev/null && netbird status 2>/dev/null | grep -q "Management: Connected"; then
     MESH_CONNECTED="netbird"
 elif command -v tailscale >/dev/null && tailscale status >/dev/null 2>&1; then
     MESH_CONNECTED="tailscale"
+elif curl -sfI -o /dev/null --max-time 3 "${ISSUANCE_URL_NETBIRD%/issue}/health" 2>/dev/null; then
+    MESH_CONNECTED="lan"
 fi
 if [ -z "$MESH_CONNECTED" ] && [ "$NO_SECRETS" -eq 0 ]; then
-    echo "neither netbird nor tailscale is connected; cannot bootstrap." >&2
-    echo "either bring up the mesh first, or pass --no-secrets to skip issuance." >&2
+    echo "no reachable issuance endpoint (no netbird/tailscale connected and" >&2
+    echo "$ISSUANCE_URL_NETBIRD did not respond to /health)." >&2
+    echo "either bring up the mesh first, fix DNS for *.hubris.network, or pass --no-secrets." >&2
     exit 1
 fi
 echo "[bootstrap] mesh: ${MESH_CONNECTED:-none (skipped, --no-secrets)}"