site-tailscale: prep verb + untagged VR1 (office1-mirrored) + forwarding assertion ...

Extends scripts/site-tailscale.sh to three verbs (prep|install|check) so the
per-DC .7 subnet router is brought up exactly as the working Office1 router.

- prep <site>: install the tailscale .deb from a rack-staged copy ($TS_DEB;
  the .7 has no external egress) + enable IP forwarding (/etc/sysctl.d/
  99-tailscale.conf, sysctl --system) and ASSERT it took.
- tag now OPTIONAL: TS_TAG defaults empty = untagged (office1-mirrored, VR1);
  install omits --advertise-tags and adds --accept-routes (office1 RouteAll);
  TS_TAG=tag:subnet-router restores the D-129(iii) tagged design (Roosevelt).
- check now ASSERTS IP forwarding -- the load-bearing subnet-router property
  that 'tailscale up --advertise-routes' warns-and-succeeds without, so the
  route could be approved while nothing forwards to Horizon (advisor 2026-08-07).

Harness: 23/23 (new failing-direction fixtures prep-noforward, check-noforward,
check-tag-notag, prep-fromdeb, install-tag-happy). Gauntlet ALL GREEN (102);
repo-lint 0 fail.

Records the operator's untagged/office1-mirror deferral as a D-129(iii)
amendment ([OPS], tags/autoApprovers/star ACL -> bare-metal) with the verbatim
utterance. Body: docs/changelog-20260807-dc0-tailscale-install.md.

Live install NOT yet executed (staged .deb -> dpkg -> prep -> install ->
operator Headscale approval -> check).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728