ims-pdn-up: discover the P-CSCF list once the PDN is up and hand it to imsd

With the netdev configured, the script runs imsd-pcscf against the
netdev's rmnet mux id (and the ims profile index when it knows one) and
hands the IPv6 addresses it prints to imsd as PCSCF_DISCOVERED= in
/run/imsd.env and gives the first — the daemon's fresh target — a host
route (the SA peer of a registration imsd resumes is routed by imsd itself,
as the configured address's arm already left it); IPv4 addresses and names
are logged and dropped (the PDN is IPv6-only), at most eight are handed
over, and nothing usable is logged with its cause and is not the
script's failure: imsd resumes a registration of its own when it can, else
says so and exits, and the restart runs discovery again. PCSCF= still wins and skips discovery; a list in it is refused.
The script does not read the variable from its environment: the unit
hands it the previous run's file, and a stale discovered value must not
pass for the admin's setting. The reader's path is the IMSD_PCSCF seam
the mock bench uses.

Tested: on the mock bench against this commit's script (the twelve 0.3.10
scenarios; this step's discovery arms S13–S17 and S19–S22, with S18 the
pre-existing non-IPv6 refusal; S55, the reader's rc-0 answer without an
address), and in builds of this series on the dev phone (KPN), whose PCO —
two IPv6 addresses, nothing else — reaches the plain found arm; the
configured skip, the bracketed refusal and, through the IMSD_PCSCF seam, the
reader's failure and its exit 2 ran on the phone too; the v4/FQDN line, the
eight-address cap, the IPv4-only and no-mux-id skips, the comma-list refusal
and the rc-0 arm on the mock only. On a tip build of this series (daemon
2ec1a02f62831edb; bench 40, 2026-10-13) a fresh registration reached a target
this script had not routed — the reader stubbed through the IMSD_PCSCF seam to
find none, the address in /etc/imsd.env as PCSCF_DISCOVERED= — over imsd's own
route, and a resume stood with the peer's route removed first.

implementations/main.cpp

@@ -1192,7 +1192,7 @@ private:
     // (FreshRecover), as local_ does against pdnLocal_.
     std::string pcscfTarget_;
     std::vector<std::string> pcscfCandidates_;
-    static constexpr std::string_view NoFreshPcscf = "no P-CSCF for a fresh registration: none configured (PCSCF=) and none discovered (PCSCF_DISCOVERED empty)";
+    static constexpr std::string_view NoFreshPcscf = "no P-CSCF for a fresh registration: none configured (PCSCF=) and none discovered (PCSCF_DISCOVERED empty — see the ims-pdn-up lines)";
     // The PDN's own address (LOCAL, else DetectLocal) — every fresh
     // registration's. local_ differs from it only while a resume runs on the
     // address an older registration was made on (TryResume).
@@ -1382,10 +1382,9 @@ private:
         local_ = pdnLocal_; ctx_.local = local_;
         KeepHolds();
         pcscf_ = pcscfTarget_;
-        // the target's host route is imsd's own: the bring-up script routes only
-        // the configured address (§7.2 step 3), not a target set in /etc/imsd.env
-        // as PCSCF_DISCOVERED= nor a route lost with the PDN — the same idempotent
-        // replace as a media peer's
+        // the target's host route is imsd's own: the bring-up script routes the
+        // first address of its own read, not a list set in /etc/imsd.env nor a
+        // route lost with the PDN — the same idempotent replace as a media peer's
         RunCmd({"ip", Is6(pcscf_) ? "-6" : "-4", "route", "replace", pcscf_, "dev", dev_});
         if (recovery_.Next(Boot()).at > Boot()) Log(std::format("the network's hold stands; {}", NextStep()));
         if (!WaitForPolicy()) throw Stopping{};