chore(vpn): disable vpn-egress, escalate OpenVPN→WireGuard decision

OpenVPN can't connect on this network (each port fails differently, so it's
OpenVPN-specific not a UDP block — NTP/123 works): 1197 = home OpenVPN-server
conflict; 53 = DNS interception; 8080 = TLS handshake fails across servers (MTU
on WiFi+triple-NAT). Recommend pivoting to WireGuard via thrnz/docker-wireguard-pia
(UDP 1337, MTU-robust, ADR-0013 fallback, operator's original preference) — a
spec-level (ADR-0013) change, so escalated. Disabled meanwhile. Full trace in
DECISIONS-LOG.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

DECISIONS-LOG.md

@@ -525,3 +525,22 @@ arbitrary non-53 UDP works bidirectionally, so it's port-specific (1197 conflict
 UDP block. Moved `OPENVPN_ENDPOINT_PORT` to **8080** (community-verified for PIA, non-DNS, non-1197).
 Also hit the `${VAR}`→int-coercion gotcha (k8s "expected string, got 53") — the port is hardcoded as a
 quoted string in gluetun-gateway.yaml (Longhorn-fix precedent), not a cluster-var.
+
+### Phase 3 VPN — OpenVPN unusable on this network → ESCALATE to WireGuard (thrnz) (2026-08-22)
+Tested three PIA OpenVPN UDP ports; each fails for a **different** reason (so it's OpenVPN-specific, not a
+UDP block — a raw NTP/123 probe from the host returns fine):
+- **1197** — outbound leaves, zero replies. Conflicts with the home OpenVPN server NAT'd on WAN:1197.
+- **53** — outbound leaves, zero replies. This network transparently intercepts outbound :53 (DNS), so
+  `dig` succeeds but OpenVPN-over-53 is swallowed.
+- **8080** — PIA **responds** (OpenVPN reaches the TLS handshake) but `TLS handshake failed` repeatedly
+  across servers → classic **MTU/fragmentation** (OpenVPN's large TLS handshake packets dropped on the
+  WiFi + triple-NAT path: pod→Cilium→node→libvirt-NAT→WiFi→home-NAT).
+
+**Recommendation (ESCALATED — spec-level, ADR-0013):** pivot to **WireGuard via `thrnz/docker-wireguard-pia`**
+(PIA WG = **UDP/1337**): a different port (no 1197 conflict, no 53 intercept), and WireGuard's handshake is
+small fixed-size packets → **not MTU-sensitive** like OpenVPN's TLS handshake, so it should succeed where
+8080 fails. It's ADR-0013's documented WG fallback and the operator's original preference. Trade-offs
+(per the ADR): different single-maintainer image, and PF is file-based (`/pia-shared/port.dat`) rather than
+Gluetun's control API — matters only when qBittorrent/natmap is built (Phase 6), not now. `vpn-egress`
+disabled meanwhile (crashloop would fire false alerts). Awaiting operator's architect decision before the
+container swap.