Prove a machine joins through the tunnel in a bed of its own

Two machines: the anchor raises the foundation, joins over its own
loopback and becomes the hub; the joiner makes its tunnel key, is issued
a token for it and enrols with the bus's port closed to its own address,
so the enrolment can arrive only over the tunnel (novox/hq ADR 0169). The
check that had been added to the two-node walk moves here, closing the
port the bundle publishes the bus on rather than the bus's own.

And the uplink's range may be named: behind a VPN client that routes
every private range, incus had none left to pick and no scenario could
be raised.

test/integration/mesh.test.ts

@@ -1706,30 +1706,5 @@ test("a third-party workload is adopted, with the credential it already had", {
 // assertions (a write outside the consumer's keys and a FLUSHALL are refused) moved into
 // mesh-grant-end-to-end, against the catalogue's redis.
 
-// **A machine joins through the tunnel, and needs the bus only through it** (novox/hq ADR 0169).
-// The bus is closed to this machine at the anchor's very first hook, before the container runtime's
-// forwarding, so the only way its enrolment can arrive is over the tunnel the token gave it.
-test("a machine joins through the tunnel, with the bus closed to it", { skip, timeout: 900_000 }, async () => {
-  await must("anchor", `nft add table ip lab_bus_closed && ` +
-    `nft add chain ip lab_bus_closed pre '{ type filter hook prerouting priority -300; }' && ` +
-    `nft add rule ip lab_bus_closed pre ip saddr 192.0.2.30 tcp dport 4222 drop`);
-  try {
-    await must("joiner", `pacman -Sy --noconfirm --needed wireguard-tools >/dev/null 2>&1`);
-    const key = (await must("joiner", `${HOST_PATH} key 2>/dev/null`)).trim();
-    assert.match(key, /^[A-Za-z0-9+/]{43}=$/, `not a tunnel key: ${key}`);
-    // Asked again, the same key: a token may already have been issued for it.
-    assert.equal((await must("joiner", `${HOST_PATH} key 2>/dev/null`)).trim(), key);
-
-    const token = tokenFrom(await mesh(`token issue --new joiner --overlay-key ${key}`));
-    await composeTheBusUsers();
-    const said = await must("joiner", `${HOST_PATH} enrol --token ${quote(token)}`);
-    assert.match(said, /the tunnel to the hub is up/, said);
-    assert.match(said, /enrolled as joiner/, said);
-
-    const shakes = await must("joiner", `wg show mesh0 latest-handshakes`);
-    assert.ok(/\s[1-9]\d*\s*$/m.test(shakes), `the tunnel never shook hands with the hub: ${shakes}`);
-  } finally {
-    await on("anchor", `nft delete table ip lab_bus_closed`);
-  }
-});
-
+// A machine joining through the tunnel with the bus closed to it is its own bed:
+// joins-through-the-tunnel.test.ts (novox/hq ADR 0169).