Block B complete: d124-transit-seed tooling + full D-124 NetBox import ...

Operator chose "write the seeder". netbox/d124-transit-seed.py (NEW) + harness
(21/21, incl. a cross-file consistency check so the seeded role/container can't
drift from dc-rack-mgmt-import's required ROLE_SLUG/CONTAINER) -- mirrors
d115-office-carve (NB client, sandbox gate, WAF UA, dry-by-default). Seeds ONLY
the transit role + the 172.31.0.0/24 UNSCOPED container (mirrors edge's /16).

Ran on the apex (gated, dry-run-verified, token server-side, sandbox-only):
seed -> role transit (id=30) + 172.31.0.0/24 (id=137); then dc-rack-mgmt-import
placed 172.31.0.0/30 (transit, vr1-dc0) + 10.12.8.2/22 (rack, dns=vvr1-dc0),
matching the vr1_dc0_rack_* tfvars. Full D-124/edge-WAN IPAM now in the apex.

changelog/ledger/readiness updated (Blocks A+B DONE).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH

NetBox apex recovery + restart policy + edge-WAN import (Block A) ...

Found the IPAM apex (office1-netbox, netbox-docker) DOWN -- cleanly exited ~3h prior,
no auto-restart. Operator-approved: brought it up (docker compose up -d, HTTP 302) and
added restart: unless-stopped to all 5 services so it survives instance reboots (incl.
the bookend); override backed up on host, config-validated before apply.

Block A committed (gated, dry-run-verified): dc-edge-wan-import created 172.30.2.0/24
(vr1-dc0) + 172.30.3.0/24 (vr1-dc1), role edge. Token read server-side on the apex host
(never in agent context); sandbox-only, upstream untouched.

Block B (D-124 rack) BLOCKED: dc-rack-mgmt-import dies on 'role transit absent' -- the
transit role + 172.31.0.0/24 container have no seeder. Pending operator tooling decision
(decoupled from the deploy). as-built + ledger updated; changelog added.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ck6xh3jWQi5b3Su8Dx1LEH