Final gate re-verified: opentofu-validate clean, the four vr1_dc0_rack_* +
vr1_dc0_ssh_pubkey_path tfvars in place, creds-audit vr1-dc0 CLEAN, gauntlet ALL
GREEN (65), repo-lint 0-fail. netem clarified as deploy-time (Step 11, the module
isn't pre-instantiated -- no prep tfvar). NetBox import clarified as decoupled
hygiene (importer not on the apex host; no netbox provider in the tree).

Remaining is NOT prep: the bookend restart (vcloud + voffice1 + opnsense patched
and rebooted together -- voffice1 is load-bearing like vcloud, so it defers with
it, not mid-prep) as the boundary into the new session; then fresh-session re-verify
of the plan + logged shell + gated outer apply. Readiness doc + ledger marked
PREP COMPLETE.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH