feat: allow machines join to advertise an endpoint IP

[alongubkin]

Summary

Add join --public-ip <IP> to the Machines CLI for hosts whose endpoint address cannot be inferred from their outbound connection, including hosts reachable through a VPN.

This is separate from deploy --public-endpoint, which supplies a complete URL for externally managed ingress. The new flag controls the machine address reported to the control plane for managed endpoint DNS.

The override is written to the machine configuration, saved across rejoins, and can be cleared with --public-ip auto. Changing it reconfigures the existing service without reinstalling the bundle. A bundle that lacks the publicIp config entry fails clearly instead of silently ignoring the flag.

Credential recovery now applies a pending configuration change after refreshing machine credentials. Bundle support is checked before changing the join token.

The PR also repairs a pnpm lockfile mismatch introduced on main by the Node types update in #733. Without this repair, the PR's Rust and TypeScript CI jobs both fail during frozen dependency installation, before tests run.

Verification

• cargo fmt --all --check
• cargo test -p alien-deploy-cli --lib (170 passed)
• pnpm install --frozen-lockfile --lockfile-only

Rollout

Publish a machine bundle whose manifest has the optional publicIp config entry before using the flag. Then publish a generated CLI package containing this change. Verify on a Machines host that its heartbeat reports the chosen address and that the endpoint DNS points there.

Linear: ALIEN-1024

[greptile-apps]

Confidence Score: 4/5

[Medium risk] Adds optional endpoint IP configuration to machine join flow.

The PR should not merge until a join that refreshes rejected credentials also applies, or explicitly schedules, the requested public-IP change.

Findings

1.  Public IP change is skipped ▶
2.  Bundle rejection leaves token changed ▶

Fix with agent prompt

### Issue 1
crates/alien-deploy-cli/src/commands/join.rs:753
When an installed machine has rejected credentials, this code selects credential refresh before comparing the requested public IP. If the operator changes `--public-ip` on that join, it can report “Machine credentials refreshed” without writing the new address or reconfiguring the service. The operator must run join again to apply the change.

### Issue 2
crates/alien-deploy-cli/src/commands/join.rs:1601-1613
The unsupported-bundle check runs after `write_machine_config` has written the join-token file. On an existing installation, a failed `--public-ip` attempt with an older bundle can leave a newly supplied token on disk while the old configuration and install state remain in place. Checking bundle support before writing the token would avoid that partial change.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR adds a persisted --public-ip join override, renders it through supporting bundle manifests, and reconfigures an existing machine when the override changes.

• The credential-refresh path can defer applying a requested override without telling the operator to rerun join.
• Rejection of an unsupported bundle occurs after the join token has been written.

_{Reviews (1) · Last reviewed commit: "feat: allow machines join to advertise a..."}