fix: patch bootstrap cluster with correct config

terraform/templates/controlplane.tftpl

@@ -10,9 +10,6 @@ machine:
     key: ${ca_key}
   certSANs:
     - ${lan_ip}
-%{ if wg0_ip != null ~}
-    - ${wg0_ip}
-%{ endif ~}
 %{ for san in cloudflare_talos_sans ~}
     - ${san}
 %{ endfor ~}
@@ -28,39 +25,6 @@ machine:
         dhcp: false
         dhcpOptions:
           ipv6: false
-%{ if wg0_ip != null ~}
-      - interface: wg0
-        addresses:
-          - ${wg0_ip}/24
-        wireguard:
-          privateKey: "${wg0_private_key}"
-          listenPort: ${wg0_port}
-          peers:
-%{ for peer in wg0_peers ~}
-            - publicKey: "${peer.public_key}"
-              allowedIPs:
-%{ for ip in peer.allowed_ips ~}
-                - ${ip}
-%{ endfor ~}
-%{ endfor ~}
-%{ endif ~}
-%{ if wg1_ip != null ~}
-      - interface: wg1
-        addresses:
-          - ${wg1_ip}/24
-        wireguard:
-          privateKey: "${wg1_private_key}"
-          listenPort: ${wg1_port}
-          peers:
-%{ for peer in wg1_peers ~}
-            - publicKey: "${peer.public_key}"
-              allowedIPs:
-%{ for ip in peer.allowed_ips ~}
-                - ${ip}
-%{ endfor ~}
-              persistentKeepaliveInterval: ${peer.persistent_keepalive_secs}s
-%{ endfor ~}
-%{ endif ~}
     nameservers:
 %{ for ns in dns_servers ~}
       - ${ns}
@@ -104,8 +68,7 @@ machine:
     topology.kubernetes.io/zone: ${zone}
 %{ if !allow_scheduling ~}
   # Dedicated control plane — re-apply the control-plane taint that
-  # allowSchedulingOnControlPlanes=true removed cluster-wide. Only nodes with
-  # allow_scheduling=true (talos-cp-1 / .213) stay schedulable.
+  # allowSchedulingOnControlPlanes=true removed cluster-wide.
   nodeTaints:
     node-role.kubernetes.io/control-plane: ":NoSchedule"
 %{ endif ~}
@@ -144,9 +107,6 @@ cluster:
   apiServer:
     certSANs:
       - ${controlplane_ip}
-%{ if wg0_ip != null ~}
-      - ${wg0_ip}
-%{ endif ~}
       - ${lan_ip}
 %{ for san in cloudflare_apiserver_sans ~}
       - ${san}
@@ -188,9 +148,7 @@ cluster:
         disabled: true
       service: {}
   etcd:
-    # Advertise/peer etcd on the LAN so all control planes can reach each other.
-    # Without this, Talos may pick the WireGuard IP (10.6.0.1), which the
-    # LAN-only control planes can't route to — new members get stuck as learners.
+    # Pin etcd peer/advertise addresses to the LAN subnet explicitly.
     advertisedSubnets:
       - 192.168.1.0/24
     ca: