Deliver master.conf to a node that has no Varaverk on it yet, which is the node that needs it

Phase 1 exists to hand the partner its identity before the install, but the push refused any
host without varaverk.cfg — so the conf could only ever reach a node that no longer needed it
to be told who it was. It now resolves the remote's conf directory across both install layouts
and creates the internal one when neither exists.

Plugin/varaverk.plg

@@ -220,6 +220,16 @@ else
 fi
 
 # Seed master.conf from template if absent.
+#
+# "If absent" is load-bearing, not defensive. Phase 1 of partnership onboarding pushes the
+# owner's master.conf to this host BEFORE the plugin is installed — it lands in exactly this
+# directory, which the push creates. That conf already names HOST1 and HOST2, which is how the
+# setup wizard knows this machine's identity without asking for it. Overwriting it with the
+# template here would replace a populated conf with one whose HOSTn slots are all empty and
+# throw the wizard back to the questions the push exists to answer.
+#
+# The clone above cannot destroy it either: every conf is gitignored, so it is untracked and
+# `git reset --hard` leaves it alone.
 mkdir -p "$CONF_DIR"
 if [[ ! -f "$CONF_DIR/master.conf" && -f "$DEPLOY_DIR/master.conf.template" ]]; then
     cp "$DEPLOY_DIR/master.conf.template" "$CONF_DIR/master.conf"