tune(vpn): --mtu-disc no so oversized handshake packets fragment (not drop)

RSA-4096 strong-preset handshake is marginal over the 1450 pod MTU (Cilium VXLAN).
--mtu-disc no clears DF so oversized control packets fragment through instead of
being silently dropped. Last MTU-path lever (OpenVPN 2.6 has no --tls-mtu).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

platform/vpn-egress/gluetun-gateway.yaml

@@ -70,9 +70,9 @@ spec:
             - name: OPENVPN_MSSFIX
               value: "1300"                  # clamp TCP-in-tunnel to match
             - name: OPENVPN_FLAGS
-              value: "--hand-window 120"     # OpenVPN 2.6 has no control-channel MTU option (--tls-mtu is
-                                             # invalid) and PIA doesn't support --fragment; so just give the
-                                             # RSA-4096 handshake 120s (vs 60s default) to complete over loss.
+              value: "--hand-window 120 --mtu-disc no"   # --mtu-disc no clears the DF bit so oversized RSA-4096
+                                             # handshake packets FRAGMENT through the 1450 pod MTU instead of being
+                                             # silently dropped; --hand-window 120 gives the handshake more time.
             # PIA credentials from the SOPS secret (Gluetun's PIA OpenVPN creds env):
             - name: OPENVPN_USER
               valueFrom: