fix(snmp): ask for the old community per device, not once

[Gerrrt]

Follow-up to #28, which noted this as deliberately out of scope.

What changed

--old prompted once and tested that single string against every device. It now
asks each device separately.

Why

One prompt was correct when a single community was shared across all four
devices. After the rotation each has its own predecessor, so:

• a string entered once proves nothing about the three devices it never
  belonged to, and
• there was no way at all to check a device whose old community differed from
  the rest — which is exactly the case for neo.

Enter skips a device, since the usual case is checking the one you just rotated.
Skipping every device is now an error rather than a silent pass: a run that
checked nothing must not print all SNMP targets verified.

Implementation note

The prompt reads from /dev/tty explicitly. The loop’s stdin is the device
inventory, so a bare read would have consumed a device row instead of waiting
for input — the loop would have silently eaten its own work list.

The terminal requirement is unchanged, and each community still reaches net-snmp
only through a 0600 snmp.conf inside a 0700 directory removed on every exit
path, including Ctrl-C.

Blast radius

One script and one runbook section. No config, no service, no credential, no
segmentation change.

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Verification

All three branches exercised against the live lab, through a pty so the terminal
requirement stayed honest.

A deliberately wrong community — correctly reported as refused:

  old community for neo        (not echoed, Enter to skip):
  PASS neo        10.7.7.2     rejected

A community the device does still accept — correctly caught, run fails:

  FAIL neo        10.7.7.2     STILL ACCEPTED — the device added the new community alongside the old one; delete the old entry

snmp verification failed

Every device skipped — refuses to claim success:

error: no old community entered for any device — nothing was checked

shellcheck clean, ./scripts/validate.sh passes, markdownlint-cli2 clean.

• make validate passes
• Deployed to the lab and confirmed working
• Docs updated (docs/runbooks/rotate-snmp-community.md §2.5)

Refs #9