D-129: build the OPNsense edge plugin profile-installer + sharpen pins ...

Autonomous processing of D-129 items that need no operator keyboard. Repo-only;
NOTHING applied to the cloud (live plugin install stays classifier-gated).

- NEW scripts/opnsense-plugins.sh + tests/opnsense-plugins/ (17/17): named-profile
  installer over the D-113 firmware API. Installs ONE plugin at a time + polls
  upgradestatus (the firmware-lock lesson), delegates auth to opnsense-api.sh,
  warns os-qemu-guest-agent != a working agent, offline --dry-run. Closes the
  "build the reusable installer" pin.
- D-129 + dc-dc-phase2 pin: installer recorded as BUILT (use it, not build it);
  qga channel logged as an OPT-IN-var design (default OFF -> no office1/DC0-plan
  side-effect; dmacvicar 0.9.8 mechanism-to-verify); os-git-backup operator ask.
- Gauntlet ALL GREEN (68), repo-lint 0-fail.

Revert: git rm the script+harness; revert the doc/runbook edits.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz