`make` or `make mx-networkd/target/release/mx-networkd` builds the binary
with cargo, `make install` puts it into `/usr/sbin/mx-networkd` and
installs the same binary as the generator
`/usr/lib/systemd/system-generators/mx-networkd-generator` (it recognises
being called under that name).

The install is skipped when the binary was not built, so `install.sh` keeps
working standalone on a machine without a Rust toolchain.

Installing the generator does not change any behaviour by itself: it only
writes to `/run/systemd/network/`, which nothing reads unless
`systemd-networkd` is enabled on that machine.

Assisted-by: Claude Fable 5 <noreply@anthropic.com> (thanks to @boris)

network.service removes the primary address in ExecStop, so
'systemctl disable --now network.service' over SSH drops the
connection and locks the admin out of the machine.

Flip the units without --now and let the reboot do the swap: the old
units run until shutdown, the generator and the .link files take over
at the next coldplug, and the two mechanisms never overlap. The
rollback gets the same treatment.

Assisted-by: Claude Fable 5 <noreply@anthropic.com> (thanks to @boris)

…nerator

Make the hostconfig tag mx-network-generator the single per-machine switch
between the old and the new network setup (hyphens are fine in tag names:
hostconfig matches tag terms with [a-z][a-z0-9$_-]*):

* network.service and mxvlan.service get
  ConditionPathExists=!/node/tags/mx-network-generator, so they keep
  running everywhere until a machine carries the tag.
* systemd-networkd.service gets a drop-in with
  ConditionPathExists=/node/tags/mx-network-generator, so it never fights
  the old units on a machine that has not been switched over.
* mx-networkd generate writes nothing while the tag is absent and prunes
  files it wrote earlier, so a rollback needs nothing beyond removing the
  tag. /node/tags/ persists across boots and generators run before
  startup-tags.service, so the previous boot's populate-node result is
  what gates the generator. --dry-run ignores the tag so the preview
  always works; check now reports the tag state.

Assisted-by: Claude Fable 5 <noreply@anthropic.com> (thanks to @boris)

Add mx-networkd/migrate-to-mx-networkd.sh, installed as
/usr/sbin/migrate-to-mx-networkd. It prepares the reboot-based switchover
without touching the running network, so it is safe over SSH and
idempotent:

* checks that binary, generator, drop-in and conditioned units are
  installed and that /etc/local/mxhost.conf and /etc/local/mxnet exist
* validates the configuration with mx-networkd check and shows the
  generate --dry-run preview for comparison with the running state
* verifies the mx-network-generator tag is set in /etc/hostconfig (and
  prints the exact line to add on the distmaster if not - /node/tags/ is
  rebuilt from /etc/hostconfig at every boot, so a locally touched tag
  file would not survive)
* runs hostconfig --populate-node and enables systemd-networkd.service
  for the next boot only - nothing is started, stopped or reloaded
* prints a summary and reboot-based rollback instructions

Rewrite the README migration section around the tag and the script.

Assisted-by: Claude Fable 5 <noreply@anthropic.com> (thanks to @boris)

hostconfig does not support hyphens/minus in tag names after all:

    == checking hostconfig tag 'mx-network-generator'
    Invalid [] range "x-n" in regex; marked by <-- HERE in m/^[a-z][a-z0-9mx-n <-- HERE etwork-generator-]*$/ at /usr/sbin/hostconfig line 43.

Leave the the hyphens in the drop-in name, as it’s easier to read. The
tag is going to be removed after the migration finished.