A module can name the mesh's range: ${machine:mesh-range} (novox/hq ADR 0112)

A module cannot know the private network's CIDR — it is a per-mesh value chosen
at genesis — but sometimes must name it: an intrusion filter that must never
ban a tunnel peer. Carry the overlay range on the Rendering and offer it as the
machine fact mesh-range, the same way a machine's own address is offered, so the
module names it rather than hardcoding a value (data is the mesh's). Absent when
the mesh has no range. Enables the fail2ban ignoreip fix.

cmd/mesh-controller/plan.go

@@ -488,6 +488,13 @@ func renderingFor(ctx context.Context, open *stores, node string,
 	if err != nil {
 		return catalogue.Rendering{}, inventory.Node{}, err
 	}
+	// The private network's range, offered to a module as ${machine:mesh-range} — a module that must
+	// name the whole mesh (an intrusion filter that must never ban a tunnel peer) names it here
+	// rather than hardcoding a value it cannot know.
+	meshRange, err := overlayRange(ctx, inv)
+	if err != nil {
+		return catalogue.Rendering{}, inventory.Node{}, err
+	}
 
 	// The artifact store as this node reaches it now — the address every image and archive the
 	// mesh built is fetched through, composed here and recorded nowhere — with what the mesh has
@@ -597,8 +604,9 @@ func renderingFor(ctx context.Context, open *stores, node string,
 		Settings: settings, Generators: gens, Grants: grants, Needed: needed, Ports: ports,
 		Certificate: certificate, Authority: authority, Mesh: private, Names: names,
 		Machines: machines,
-		Suffix:   overlay.Suffix(), Foundation: foundation, Kept: kept, Adopted: record.Adopted,
-		Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, Built: built,
+		Suffix:   overlay.Suffix(), MeshRange: meshRange, Foundation: foundation, Kept: kept,
+		Adopted: record.Adopted,
+		Given:   given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, Built: built,
 	}, record, nil
 }