netbox: office1-record dumper (source separation) + current apex snapshot ...

Operator-directed: one dump script per SOURCE so a credential/URL can never be
confused (the token never travels -- read from env).

- netbox/office1-record-dump.py (NEW): READ-ONLY dumper for the office1-netbox
  RECORD -- the VR1 working apex (10.10.1.10:8000, 4.6.4, v2 token). This is what
  every VR1 system actually consumes (DOCFIX-195) and what the dc0/dc1 buildout
  edited -- i.e. the CURRENT in-cloud NetBox state.
- netbox/prod-draft-dump.py: docstring clarified -- it pulls ONLY the FROZEN v1
  reference (netbox.baldurkeep.com), not the working apex.
- tests/office1-record-dump/run-tests.sh (NEW): offline harness 5/5 (slim /
  prefix-scope rewrite / range key / source-target).
- netbox/draft/vr1-office1-current-20260725.json (NEW): the current snapshot --
  139 prefixes / 11 sites (incl. vr1-dc0/dc1/off1), dc1 bands 10.12.64/68/72.0/22
  present; differs from the 90-prefix frozen reference. For the Chat design
  session (NetBox->deploy coupling) which has no live infra.

READ-ONLY: nothing written to NetBox. repo-lint 0-fail.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw