fix: manual-net-ifaces.d ordering never applied, vmbr0 randomly unconfigured

After= was placed in [Service], which systemd ignores ('Unknown key
After'), so the interfaces.d merge + ifreload raced networking.service
on every boot. On losing boots vmbr0 never ran DHCP and the proxmox
guest came up without its LAN IP (bridging still worked, so inner VMs
stayed reachable while the PVE host itself was not).

Move After= to [Unit] ordering against networking.service, and mkdir
/run/network in ExecStartPre: the image-build workaround for
ifupdown2#276 doesn't survive boots since /run is tmpfs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib/images/linux/debian/templates.nix

@@ -50,11 +50,18 @@ with scriptsNFiles;
       # proxmox makes it very hard to manually add interfaces directly on /etc/network/interfaces while the pve services are not running
       # it also doesn't pick up files in interfaces.d
       # so manually do that via service after boot
+      # After= must live in [Unit] — in [Service] systemd ignores it, leaving the
+      # merge/ifreload racing networking.service (and ifreload fails outright if it
+      # runs before /run/network exists, see ifupdown2#276).
       mergeNetIfacesDService = pkgs.writeText "manual-net-ifaces.d.service" ''
+        [Unit]
+        After = networking.service
+        Wants = networking.service
+
         [Service]
         Type = oneshot
+        ExecStartPre = /bin/mkdir -p /run/network
         ExecStart = /bin/bash -c "cat /etc/network/interfaces.d/* >> /etc/network/interfaces; rm /etc/network/interfaces.d/*; ifreload -a;"
-        After = network.target
 
         [Install]
         WantedBy = multi-user.target