Re-imaging the same PC: clear its stale SMB/conntrack state every time

A PC whose imaging failed and is re-imaged gets the same IP, and the
server still held state from the dead run, so net use failed (System
error 53). The April fix (18537ac) did not cover it:

- The dnsmasq hook only acted on 'add'/'del'. A re-image comes back to the
  existing lease, which dnsmasq reports as 'old', and only when the
  hostname/MAC changed. Now dnsmasq sets script-on-renewal, and the hook
  clears state on 'old' when the request comes from PXE firmware or iPXE
  (vendor class PXEClient), i.e. the machine just network-booted. A
  Windows lease renewal (MSFT 5.0) is left alone.
- The 1 h conntrack timeout never applied after a reboot: systemd-sysctl
  runs before ufw loads nf_conntrack, so the keys did not exist and the
  5-day default stayed. /etc/modules-load.d/pxe-conntrack.conf loads it
  first.
- smb-soft-reset.sh flushed neighbours on br-pxe, which no longer exists.

Live 2026-10-14. Hook tested on the server with an unused IP: network-boot
renewal clears, Windows renewal and no vendor class do not, add clears.

playbook/pxe-server-helpers/smb-soft-reset.sh

@@ -15,7 +15,7 @@
 # Step 3: restart smbd         (full smbd restart, kills all child sessions)
 # Step 4: kill any leftover smbd child processes that survived restart
 # Step 5: flush conntrack for 172.16.9.0/24 (kernel connection tracking)
-# Step 6: flush ARP / neighbour cache on br-pxe
+# Step 6: flush ARP / neighbour cache
 # Step 7: drop TCP sockets on port 445 via ss -K
 # Step 8: restart dnsmasq      (DHCP/TFTP state as a last resort before reboot)
 
@@ -65,8 +65,8 @@ else
 fi
 pause "Step 5 done"
 
-echo "=== Step 6/8: flush ARP / neighbour cache on br-pxe ==="
-ip neigh flush dev br-pxe 2>&1 || ip neigh flush all 2>&1 || true
+echo "=== Step 6/8: flush ARP / neighbour cache ==="
+ip neigh flush all 2>&1 || true
 pause "Step 6 done"
 
 echo "=== Step 7/8: drop tcp sockets on port 445 ==="