D-115 office carve IMPORTED into the Office1 NetBox; DC import blocked on ORG_ULA_48 ...

netbox/d115-office-carve.py (+ tests/d115-office-carve/ 20/20 PASS)

Applied to the Office1 sandbox: site vr1-off1, roles office + edge (edge is NEW),
and 8 prefixes. Idempotent (re-run: 0 created / 11 present).

  10.10.0.0/16      office container   the Office v4 block, /22 per office
  10.10.0.0/22      office container   VR1 Off1's /22
  10.10.0.0/24      office active      office1-local LAN   (Kea on the edge)
  10.10.1.0/24      office active      lxdbr0 compose net  (MAAS DHCP)
  172.30.0.0/16     edge   container   NEW Edge role; mirrors v6 2602:f3e2:fe::/48
  172.30.1.0/24     edge   active      office1-wan, the simulated ISP uplink
  2602:f3e2:f01:/56  office container  mirrors VR0 Off0's e01:/56
  2602:f3e2:f01:/64  office active     office subnet (NOT deployed; v6 has no egress)

Every address was already RUNNING. D-115 blesses what is deployed -- zero
renumber. What it fixes is that three of them were SQUAT: on the wire with no
allocation behind them.

Writing upstream is GATED IN CODE: the tool refuses a non-sandbox target unless
given --yes-write-upstream. Feeding the production apex is an operator decision,
never a side effect of running an import.

BLOCKED, deliberately: dc-dc-prefixes-import.py --dc dc0 CANNOT run. It needs
ORG_ULA_48, which is still UNASSIGNED (gap G3; the scope doc recommends
fd50:840e:74e2::/48 but no ADOPTED decision assigns it -- grep ORG_ULA
design-decisions.md returns nothing). Using it anyway would be an inferred value
(hard rule 2). This is a DECISION gate, not a tooling gap: the tooling is fixed,
tested and ready. Recorded in the ledger with the exact commands to unblock.

Also: docs/vr1-office1-as-built.md gains the IPAM table, and records that the
Tailscale 10.10.0.0/22 route is now ENABLED (edge GUI reachable from the
workstation with no tunnel), superseding the tunnel instructions.

repo-lint 0 fail. run-tests-all: ALL GREEN (55 harnesses).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013ZBxzAbmqwLW7jEmMG23Xw