More work: PSC recipe.
Don't rebuild iptables rulesets immediately for zeroconf.

Previously, if node provisioning failed halfway through, we'd end up
with an iptables ruleset that blocked SSH access.  That's no good for
development.

(Hopefully this won't affect zeroconf startup.)