Provision the dc0 Tailscale .7 subnet-router toward phase-03 Step 3.3
(Horizon over the tailnet). LIVE (gated): set power_type=virsh on the
already-enlisted known-marten (n4parh) via the DC-region-reachable
10.12.8.2 address, commissioned -> Ready.

Tooling (hard rule 4 -- no artifact carved this 2-leg shape):
- lib-hosts.sh CARVE_AUX_HOSTS isolates the .7 VM from every HOSTS
  consumer; inert octet(7)/boot-MAC entries; NODE_CARVE_TAILSCALE_PLANES.
- dc-node-carve.sh is_tailscale_host/is_two_plane_host -> metal-admin +
  provider-public RAW, no OVS br-ex (juju-controller idiom, octet 7),
  keyed on stable lib-hosts name + boot MAC; --host accepts aux, bare
  apply still HOSTS-only.
- harness t01/emit_tailscale + T28..T33 (pass + tsbrex/tscarved failing
  directions). 58/0; repo-lint 0 fail; gauntlet ALL GREEN (101).

Implements D-129(iii) amdt (2026-08-07) + D-134 octet map; no new D-num.
Operator rulings: dc1 "No migration. Build region on DC1 correctly.";
join key is plain (not tag-scoped) -> tailscale JOIN stays blocked on a
tagged key + Headscale autoApprovers/ACL (N1). Provisioning to
carved-and-ready is unblocked.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728