refactor: make engine domain-agnostic — identity from node.env, no hardcoded domain

Drop the hardcoded-domain FQDN regex and every hardcoded domain from commons.
Node identity is now explicit in node.env: APEX_NODE_FQDN (real FQDN,
traefik Host()), APEX_NODE_HOST (public host name — backup --host,
obs/notify instance), APEX_SUBNET. The short name (log prefix, sync/<node>
branch, messages) is derived as the first host label.

notify instance is just the host (no hardcoded prefix); the git bot identity
moves to APEX_GIT_AUTHOR_NAME/EMAIL (node.env) with generic defaults. Alloy
node+instance labels use APEX_NODE_HOST. Fallbacks keep a node working if it
omits a var (host<-fqdn<-hostname).

BREAKING CHANGE: removes APEX_NODE and APEX_CLUSTER env vars; node name is now derived from APEX_NODE_FQDN

tests/test_identity.py

@@ -3,40 +3,37 @@ import os, tempfile, unittest
 from engine.identity import resolve, Node
 
 class TestIdentity(unittest.TestCase):
-    def _envfile(self, text, dirname=None):
+    def _envfile(self, text):
         d = tempfile.mkdtemp()
-        if dirname:
-            d = os.path.join(d, dirname)
-            os.makedirs(d)
         with open(os.path.join(d, "node.env"), "w") as f:
             f.write(text)
         return d
 
-    def test_fqdn_is_source_of_truth(self):
-        repo = self._envfile("APEX_CLUSTER=a1\nAPEX_SUBNET=198.18.11.0/24\n")
-        n, warns = resolve("daedalus.a1.apex.ermnvldmr.com", repo)
-        self.assertEqual((n.name, n.cluster, n.subnet), ("daedalus", "a1", "198.18.11.0/24"))
+    def test_explicit_host_and_fqdn(self):
+        repo = self._envfile("APEX_NODE_FQDN=icarus.a1.example.com\n"
+                             "APEX_NODE_HOST=icarus.example.com\n"
+                             "APEX_SUBNET=198.18.17.0/24\n")
+        n, warns = resolve("build-laptop", repo)   # hostname ignored when node.env has FQDN
+        self.assertEqual((n.name, n.host, n.fqdn, n.subnet),
+                         ("icarus", "icarus.example.com", "icarus.a1.example.com", "198.18.17.0/24"))
         self.assertEqual(warns, [])
 
-    def test_cluster_drift_warns_hostname_wins(self):
-        repo = self._envfile("APEX_CLUSTER=a9\nAPEX_SUBNET=198.18.11.0/24\n")
-        n, warns = resolve("daedalus.a1.apex.ermnvldmr.com", repo)
-        self.assertEqual(n.cluster, "a1")           # hostname wins
-        self.assertTrue(any("drift" in w.lower() for w in warns))
+    def test_host_defaults_to_fqdn(self):
+        repo = self._envfile("APEX_NODE_FQDN=n1.example.com\nAPEX_SUBNET=10.0.0.0/24\n")
+        n, warns = resolve("ignored", repo)
+        self.assertEqual((n.name, n.host, n.fqdn), ("n1", "n1.example.com", "n1.example.com"))
+        self.assertEqual(warns, [])
 
-    def test_fallback_when_fqdn_not_apex_shaped(self):
-        # repo dir basename carries the node name in fallback (real host layout:
-        # $HOME/morpheus.apex.ermnvldmr.com)
-        repo = self._envfile("APEX_CLUSTER=a2\nAPEX_SUBNET=198.18.13.0/24\n",
-                             dirname="morpheus.apex.ermnvldmr.com")
-        n, warns = resolve("build-laptop", repo)
-        self.assertEqual((n.name, n.cluster, n.subnet), ("morpheus", "a2", "198.18.13.0/24"))
-        self.assertTrue(any("fqdn" in w.lower() for w in warns))
+    def test_fqdn_falls_back_to_hostname(self):
+        repo = self._envfile("APEX_SUBNET=10.0.0.0/24\n")
+        n, warns = resolve("box.local", repo)
+        self.assertEqual((n.name, n.host, n.fqdn), ("box", "box.local", "box.local"))
+        self.assertTrue(any("APEX_NODE_FQDN" in w for w in warns))
 
     def test_missing_subnet_is_error(self):
-        repo = self._envfile("APEX_CLUSTER=a1\n")
+        repo = self._envfile("APEX_NODE_FQDN=n1.example.com\n")
         with self.assertRaises(SystemExit):
-            resolve("daedalus.a1.apex.ermnvldmr.com", repo)
+            resolve("n1.example.com", repo)
 
 if __name__ == "__main__":
     unittest.main()