The NODE-SIDE half of the D-129(iii) per-DC operator-access build (rulings a-d):
runs ON the .7 subnet-router VM, advertises THIS DC's metal-admin /22 to the
tailnet with a TAGGED identity, SNAT on (default, ruling d), site-keyed like
dc-rack-net.sh (check/install, fails closed). Metal-admin CIDR per site is a
MEASURED table row (10.12.8.0/22 dc0 / 10.12.68.0/22 dc1) cross-checked against
the router's own .7 leg at runtime. Control plane tailscale.baldurkeep.com
(MEASURED). The Headscale-side prerequisites (tagged pre-auth key, autoApprovers
written BEFORE first advertise, star ACL) are control-plane work, deferred until
access -- the script fails closed without them.

Harness 15/15: every exit path (0/1/2/4) has a failing-direction fixture; the
happy-case fixtures caught a real jget quote-collision bug (bracket-key path
inside an eval string) that made the negative checks pass for the wrong reason.
gauntlet ALL GREEN (101); HARNESS-MANIFEST recorded 100->101; repo-lint 0 fail.

REVERT: git rm scripts/site-tailscale.sh && git rm -r tests/site-tailscale
  && bash scripts/run-tests-all.sh --record-manifest

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728