Fix two bugs in last round's fixes, and stop --full hiding the Docker host

Round 3 found defects in code written an hour earlier. Both reproduced.

**The handshake poll accepted empty output as a completed handshake.**
`[ "$(… | awk '{print $2}')" != 0 ]` is *true* when `wg show` prints nothing —
which it does when the interface has no peer, and when the interface is gone
(that message goes to stderr). `until` suspends `set -e` and `pipefail`, so
nothing else caught it. The poll added last round to make "success without a
tunnel" impossible produced exactly that. Now requires a number greater than
zero, and waits 20s rather than 10 so a slow link is not rolled back needlessly.

**`down` still sat above the key registration.** Last round moved it below the
token and server-list fetches but not below `addKey`, which is the most
failure-prone of the three — one gateway, by CN, pinned certificate. So a
refused registration still tore down a working tunnel. It now runs after the
last fetch; the key is generated before but written after, since `down` deletes
it. SKILL.md said "after every network fetch has succeeded", which was false;
corrected.

**`up --full` made `host.docker.internal` unresolvable — and `status` said DNS
was fine.** That name is answered only by the resolver being replaced; it is not
in `/etc/hosts`. `gateway.rs` hands it to every container for the LiteLLM
gateway, and Ollama and custom endpoints default to it, so an agent running
`up --full` silently removed the project's model backend. The route was already
excluded; only the name was lost. Now resolved with the old resolver and pinned
into `/etc/hosts` before the swap, restored on teardown, and `status` probes it
— PIA answers public names happily, which is precisely why probing only
`api.anthropic.com` reported "ok". Documented as Trap 4.

**The rollback could abort halfway.** The trap's `{ … }` is not exempt from
`set -e`, and `down`'s `cat`/`tac`/`rm` had no `|| true` — so one failure left
the interface up with all traffic captured, after printing "rolling back".
`down` now runs under `set +e`, the trap tolerates its failure, and the
interface is deleted *first*, since that removes every route pointing at it.

**The account password had a real argv window.** curl does blank `-u`, but only
once running: sampling /proc/<pid>/cmdline caught the plaintext in 2 of 400
tries, between exec and the overwrite. Small, but it is the permanent password
and the token already had the fix. Moved onto the same stdin config — 0 of 400.
Review reported this as a 25-second exposure; that was a wrapper's argv, not
curl's.

entrypoint: the skill install stages into `$_dest.new` and swaps, so a failed
copy leaves the previous copy intact instead of a truncated SKILL.md and no
script, root-owned, on a persisted volume. Verified against a size-limited
filesystem.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

container/skills/pia-vpn/SKILL.md

@@ -9,7 +9,7 @@ Bring this container's traffic out through Private Internet Access over
 WireGuard, using the API PIA documents for headless use.
 
 Run `sudo ~/.claude/skills/pia-vpn/pia-wg.sh` with `up`, `up --full`, `down` or
-`status`. Read the rest of this page before the first `up --full` — three of the
+`status`. Read the rest of this page before the first `up --full` — four of the
 behaviours below are actively misleading if you meet them without warning, and
 each one presents as "the VPN is fine" or "Claude is broken" rather than as
 what it is.
@@ -107,7 +107,21 @@ mode: test route only (1.1.1.1 through the tunnel, nothing else)
 Two different addresses there is correct and expected in test mode. If you want
 the second line to change, you want `up --full`.
 
-## Trap 4: no tunnel survives a restart, and it fails open
+## Trap 4: a full tunnel hides the Docker host unless the name is pinned
+
+`host.docker.internal` is answered *only* by the resolver that `up --full`
+replaces — it is not in `/etc/hosts`. Triple-C hands that name to the container
+for the LiteLLM gateway, and host-side Ollama and custom endpoints default to
+it, so losing the name takes the project's model backend down with it.
+
+The nasty part is what a naive check reports. PIA's resolvers answer public
+names perfectly well, so a probe of `api.anthropic.com` says everything is fine
+while the Docker host has vanished. `pia-wg.sh` pins the address into
+`/etc/hosts` before swapping the resolver and restores the file on teardown, and
+`status` probes both names — but if you ever rewrite `resolv.conf` by hand, this
+is the one that will not announce itself.
+
+## Trap 5: no tunnel survives a restart, and it fails open
 
 The network namespace is rebuilt every time the container starts, and nothing
 inside reconnects anything. After a stop/start, Reset or any config change that
@@ -186,10 +200,11 @@ no DNS at all), removes exactly the routes that were added, in reverse order,
 and deletes the interface. It is safe to run when nothing is up. Confirm
 afterwards that the public address is back to the container's own.
 
-`up` calls it too, but only *after* every network fetch has succeeded, so a
-failed `up` leaves an existing tunnel alone rather than tearing it down to
-report a bad password. From that point on a rollback is armed: if any step of
-the setup fails, the tunnel is torn down rather than left half-configured.
+`up` calls it too, but only after the last network fetch — the key registration
+— has succeeded, so a failed `up` leaves an existing tunnel alone rather than
+tearing it down to report a bad password or an unreachable gateway. From that
+point on a rollback is armed: if any step of the setup fails, the tunnel is torn
+down rather than left half-configured.
 
 The private key is deleted earlier still — the moment `wg set` has read it,
 while the tunnel is being built. That is not housekeeping: `/run` is in the