Locks the properties that matter: the octet mirror is TEXTUAL (.121 -> ::121,
never a hex conversion); the D-100 raw provider NIC is skipped for having no v4
link while br-ex is included for having one; an interface already carrying a
DIFFERENT v6 refuses rather than adding a second; a vlan with no v6 subnet is a
named error rather than a silent skip; a tag matching no machines REFUSES rather
than reporting a clean zero; and apply is dry by default.

T5 drives a fully-carved fixture to green -- every live run currently fails
because nothing is carved, and a gate only ever observed failing is as
untrustworthy as one only ever observed passing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HvCyrwvYTTcDYnRErfMsNf