A module can name the mesh's range: ${machine:mesh-range} (novox/hq ADR 0112)

A module cannot know the private network's CIDR — it is a per-mesh value chosen
at genesis — but sometimes must name it: an intrusion filter that must never
ban a tunnel peer. Carry the overlay range on the Rendering and offer it as the
machine fact mesh-range, the same way a machine's own address is offered, so the
module names it rather than hardcoding a value (data is the mesh's). Absent when
the mesh has no range. Enables the fail2ban ignoreip fix.

internal/catalogue/declaration.go

@@ -97,6 +97,12 @@ type Rendering struct {
 	// compose it a second time.
 	Suffix string
 
+	// MeshRange is the private network's CIDR (the range node addresses are allocated from), for a
+	// module that must name the whole mesh rather than one machine — an intrusion filter that must
+	// never ban a tunnel peer, say. A per-mesh value the module cannot know, so it is carried here
+	// and offered as ${machine:mesh-range}, the same way one machine's address is.
+	MeshRange string
+
 	// Kept is every operator-sealed secret in the mesh, for a module that `keeps` them. Nil when
 	// nothing on this node keeps them, or the mesh has no operator key.
 	Kept *KeptExport
@@ -545,7 +551,7 @@ func (r Resolution) compose(with Rendering, owner map[string]string) ([]map[stri
 		// (novox/hq ADR 0112) — resolved once per module, named by ${dir:…} from any resource.
 		dirs := dirsFor(m, with)
 		// And the machine underneath, which no binding of its own can tell it.
-		thisMachine := machineFacts(r, with.Names)
+		thisMachine := machineFacts(r, with.Names, with.MeshRange)
 
 		// Which of this module's files carry a secret, for the rule that a container may not read
 		// one of them as its environment without saying so (ADR 0086, issue 041).