G12 dc1: dc-rack-net.sh dc1 site-table arm + harness (D-131 sub-1) ...

Adds the dc1 arm to the standing per-DC rack-legs + node-DNS forwarder
pattern. MEASURED/apex-committed values, network-name keyed (no virbrN):
- vr1-dc1-metal-admin 10.12.68.2/22 (rack MAAS/DHCP; apex-committed rack IP)
- vr1-dc1-metal-admin 10.12.68.3/22 (forwarder listen alias; D-120 static)
- vr1-dc1-provider-public 10.12.64.2/22 (edge-LAN; measured live 2026-07-23)
- upstream region BIND 10.10.0.20 over transit

Harness T15-T18 added; dc-rack-net 18/18, gauntlet ALL GREEN (76),
repo-lint 0-fail. The forwarder pre-empts dc0's commissioning SERVFAIL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VUjEb7onHpdqFHUnio6iVw

dc-rack-net.sh: D-131 sub-1 delivery -- rack legs + node-DNS forwarder, repo-carried ...

Site-keyed (dc0 rows measured 2026-07-21), runs on the rack via piped
ssh. Legs move from reboot-lost bare `ip addr` into a oneshot unit;
bridges resolved from libvirt NET NAMES at runtime (dc-planes does not
pin bridge names -- virbrN is a drifting ID); dns unit Requires the legs
unit. 14-case harness; gauntlet 74 ALL GREEN. Rack install stays gated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01STHXiHfoxHqq8fGRVvb66G