ims-pdn-up: discover the P-CSCF list once the PDN is up and hand it to imsd

With the netdev configured, the script runs imsd-pcscf against the
netdev's rmnet mux id (and the ims profile index when it knows one) and
hands the IPv6 addresses it prints to imsd as PCSCF_DISCOVERED= in
/run/imsd.env and gives the first — the daemon's fresh target — a host
route (the SA peer of a registration imsd resumes is routed by imsd itself,
as the configured address's arm already left it); IPv4 addresses and names
are logged and dropped (the PDN is IPv6-only), at most eight are handed
over, and nothing usable is logged with its cause and is not the
script's failure: imsd resumes a registration of its own when it can, else
says so and exits, and the restart runs discovery again. PCSCF= still wins and skips discovery; a list in it is refused.
The script does not read the variable from its environment: the unit
hands it the previous run's file, and a stale discovered value must not
pass for the admin's setting. The reader's path is the IMSD_PCSCF seam
the mock bench uses.

Tested: on the mock bench against this commit's script (the twelve 0.3.10
scenarios; this step's discovery arms S13–S17 and S19–S22, with S18 the
pre-existing non-IPv6 refusal; S55, the reader's rc-0 answer without an
address), and in builds of this series on the dev phone (KPN), whose PCO —
two IPv6 addresses, nothing else — reaches the plain found arm; the
configured skip, the bracketed refusal and, through the IMSD_PCSCF seam, the
reader's failure and its exit 2 ran on the phone too; the v4/FQDN line, the
eight-address cap, the IPv4-only and no-mux-id skips, the comma-list refusal
and the rc-0 arm on the mock only. On a tip build of this series (daemon
2ec1a02f62831edb; bench 40, 2026-10-13) a fresh registration reached a target
this script had not routed — the reader stubbed through the IMSD_PCSCF seam to
find none, the address in /etc/imsd.env as PCSCF_DISCOVERED= — over imsd's own
route, and a resume stood with the peer's route removed first.

project.cpp

@@ -91,9 +91,10 @@ extern "C" Configuration CrafterBuildProject(std::span<const std::string_view> a
     //                      (org.ofono.*) bridging to imsd, for Phosh and
     //                      GNOME Mobile (GDBus translation plus the imsd-bus
     //                      polkit gate on its callers, no core).
-    //   pcscf            — imsd-pcscf, the P-CSCF reader for the bring-up: one
-    //                      QMI WDS client over a raw QRTR socket (pure std +
-    //                      POSIX, links the core for Imsd:Qmi, no GLib).
+    //   pcscf            — imsd-pcscf, the P-CSCF reader ims-pdn-up.sh runs
+    //                      once the ims PDN is up: one QMI WDS client over a
+    //                      raw QRTR socket (pure std + POSIX, links the core
+    //                      for Imsd:Qmi, no GLib).
     bool wantMedia = false;
     bool wantDialerd = false;
     bool wantOfonod = false;