SEC-010 live re-assert: idempotent nft file on voffice1 + both DC racks (operator-approved) ...

Declare-then-delete preamble inserted in place on all three hosts; sec010-fw
double-restart converged (4/2/2 drops, no duplication). Pre/post capture
docs/audit/sec010-reassert-20260723.txt; logged window ops-sec010-reassert;
per-host revert = restore .pre-reassert-20260723 backup + restart.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

Queue pass: post-G12 queued findings delivered (5 script/harness fixes + DOCFIX-198/-199) ...

- opnsense-prep-image.sh: survives bash -s (BASH_SOURCE unbound fix; T3b)
- site-headend-install.sh: version/site-neutral hints; nftables-sec010
  idempotent reload preamble; serial-log staging dir in --host-nodes (+check)
- opnsense-bootstrap-apikey.sh: sshd readiness wait + first-scp retry +
  ssh -n stdin guard + minter-beside-script usage note (T9/T10)
- DOCFIX-198: phase2 runbook Steps 9-10 SUPERSEDED banners (pod route refuted,
  D-103/D-123 amendments) + DC standup definition-of-done section (lands the
  staging-dir + SEC-016 snap-refresh re-assert DoD obligations)
- DOCFIX-199: D-112(c) console-bootstrap payload requirements (util.inc et al)

Gauntlet ALL GREEN (76); repo-lint 0 fail. Per-item reverts in
docs/changelog-20260723-queue-pass.md. No cloud mutation this session;
queued: gated live re-assert of the nftables-sec010 files on all three hosts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw