fix(mesh-cli): dial given addresses on the underlay arm

keep_address left ansible_host alone, and the lab never sets it: the
docker connection uses inventory_hostname as the container name. Switching to
SSH without writing an address made ssh resolve 'web-app-gitea-swarm-mgr-01'
through DNS, and run 37617424998 died UNREACHABLE on all three nodes in 13
minutes.

switch_to_mesh now takes the addresses to dial. A member missing from the
mapping raises instead of falling back to its mesh address, because that
fallback would have produced the meshed arm under the other arm's name - a
wrong number rather than a failed run.

cli/administration/inventory/mesh/transport.py

@@ -91,14 +91,16 @@ def switch_to_mesh(
     user: str,
     private_key_file: str,
     application_id: str = DEFAULT_APPLICATION_ID,
-    keep_address: bool = False,
+    addresses: dict[str, str] | None = None,
 ) -> dict[str, str]:
     """Point every member of *mesh_name* at its mesh address over SSH.
 
     Args:
-        keep_address: move the connection to SSH but leave ``ansible_host`` on
-            the address it already held, so a run can separate the cost of
-            leaving the local connection from the cost of the tunnel.
+        addresses: dial these addresses instead of the mesh ones, so a run can
+            separate the cost of leaving the local connection from the cost of
+            the tunnel. A member missing from the mapping raises rather than
+            falling back to its mesh address, which would silently produce the
+            meshed arm under the other arm's name.
 
     Returns:
         Host to the address it was switched to. A host with no address on this
@@ -110,12 +112,13 @@ def switch_to_mesh(
         address = mesh_address(host_vars_dir, host, mesh_name, application_id)
         if address is None:
             continue
+        if addresses is not None:
+            if host not in addresses:
+                raise KeyError(f"no address given for mesh member {host!r}")
+            address = addresses[host]
         path = host_vars_path(host_vars_dir, host)
         document = load_document(path)
-        if keep_address:
-            address = str(document.get("ansible_host") or address)
-        else:
-            document["ansible_host"] = address
+        document["ansible_host"] = address
         document["ansible_connection"] = SSH_CONNECTION
         document["ansible_user"] = user
         document["ansible_ssh_private_key_file"] = private_key_file