feat(swarm-test): add the SSH-on-underlay arm

INFINITO_SWARM_SSH_UNDERLAY runs the mesh up and gated while the deploy
stays on the underlay addresses over SSH. Unset, nothing changes.

utils/tests/swarm/mesh.py

@@ -129,6 +129,17 @@ def mesh_controller(*, inv_dir: str) -> int:
     )
 
 
+def ssh_underlay() -> bool:
+    """Whether this run moves to SSH but stays on the underlay addresses.
+
+    The third arm of the transport comparison: the mesh is up and gated, the
+    connection is SSH, and the tunnel carries nothing. Against the other two
+    arms it separates the cost of leaving ``ansible_connection: docker`` from
+    the cost of the tunnel itself.
+    """
+    return (os.environ.get("INFINITO_SWARM_SSH_UNDERLAY") or "").strip().lower() == "true"
+
+
 def switch_to_mesh_transport(*, inv_dir: str) -> int:
     """Point the inventory at the mesh before the pass that must use it."""
     if not mesh_enabled():
@@ -139,13 +150,17 @@ def switch_to_mesh_transport(*, inv_dir: str) -> int:
     hosts = sorted(
         path.stem for path in host_vars.glob("*.yml") if path.stem != _CONTROLLER
     )
+    underlay = ssh_underlay()
     switched = switch_to_mesh(
         host_vars,
         hosts,
         _MESH_NAME,
         user="administrator",
         private_key_file=os.environ.get("KEY_PATH") or _DEFAULT_ADMIN_KEY,
+        keep_address=underlay,
     )
+    if underlay:
+        print("[INFO] SSH on the underlay: the tunnel carries no deploy traffic", flush=True)
     for host, address in sorted(switched.items()):
         print(f"[INFO] {host}: ansible now connects over {address}", flush=True)
     if not switched: