Operator ruling: fixes land as we find them -- only DC1 DEPLOYMENT is gated, not DC1 fixes.

1. modules/node-vm: UNCONDITIONAL `cpu = { mode = "host-passthrough" }`. Same defect just found in
   cloudinit-vm: with no cpu block libvirt hands the guest a generic emulated CPU with NO svm. A DC
   node runs nova-compute, so it MUST run KVM guests -- there is no correct value other than this,
   hence no knob that could only ever be set wrong (contrast cloudinit-vm, where it IS a real per-VM
   decision, and opnsense-edge, which disables svm as correct hardening for a router). Not yet
   instantiated, so no live call breaks. Without it the DC nodes would have come up looking healthy
   and been unable to launch a single instance -- surfacing in Stage 5 as an inscrutable scheduler error.

2. voffice1 moved off the dynamic pool onto a RESERVED address. It first took 10.10.0.100 -- the
   first address of Kea's pool (.100-.199). A MAAS region controller must not hold an address that
   can move. Added a Kea host reservation via the D-113(a2) REST API (a second live exercise of that
   write path): 52:54:00:6a:87:e5 -> 10.10.0.20, deliberately OUTSIDE the pool. add_reservation ->
   "saved", service/reconfigure -> "ok". Rebooted; voffice1 came back on 10.10.0.20, .100 released,
   /dev/kvm still present. Done now because nothing depends on the address yet.

3. runbooks/dc-dc-phase1-office1-standup.md rewritten to the D-114 model (was: three sibling service
   VMs + an unruled Option A/B fork -- it would have actively misdirected whoever ran it). New
   sequence: voffice1 via tofu -> first contact (lease/SSH/nested-KVM) -> MAAS on voffice1 -> LXD
   (5.21 LTS) -> register LXD as a MAAS VM host -> MAAS-COMPOSE NetBox/GitBucket/Tailscale. The
   MAAS/LXD command lines carry explicit PENDING VERIFICATION markers rather than fabricated flags.
   docs/dc-dc-deployment-workflow.md Stage 2 + gap register updated to match.

repo-lint 0 fail. opentofu-validate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>