SAFETY SWEEP: mark the config.xml push path as a LIVE HAZARD (no behaviour change) ...

After D-113(a2) was proven (Office1's config is now API-managed), every instruction in the repo
that still said "render a config.xml and push it to the edge" became ACTIVELY DANGEROUS: a full
config.xml push replaces /conf/config.xml wholesale and drops ~667 migration-populated elements
(measured), including the only 2 firewall pass rules on the box. Following the old runbook steps
against the live edge would clobber it.

Warnings and headers only. No behaviour changes, no live system touched.

Marked (5 files):
  runbooks/dc-dc-phase1-office1-standup.md  DANGER banner; the config.xml render + config-ISO
                                            sub-steps removed as RUNNABLE instructions (they
                                            would clobber the live edge). Image-prep retained;
                                            history preserved in git + the build changelog.
  runbooks/dc-dc-phase2-tofu-dc-substrate.md  STOP banner on Step 4.
  scripts/opnsense-render-config.sh         DANGER header at point-of-use. NOT dead: under
                                            D-113(a2) it is to be reduced to a MINIMAL bootstrap
                                            render. Until then, safe only for a brand-new,
                                            not-yet-booted edge.
  scripts/opnsense-build-config-iso.sh      RETIRED header quoting the upstream source proving
                                            the importer can never fire on a nano image.
  docs/dc-dc-deployment-workflow.md         STALE-CONTENT warning atop the tooling gap register.

THE SWEEP ALSO CAUGHT A PRE-EXISTING LANDMINE, unrelated to today's work: dc-dc-phase2 Step 4
still instructs building a CONFIG ISO for DC1's edge -- but D-112 established that ISO can never
be read (opnsense-importer probes for a read-only root; on a pre-installed nano the root is
writable and a factory /conf/config.xml already exists, so it bootstrap_and_exit 0's without
enumerating a single device). That runbook has been telling anyone who follows it to build an
inert artifact and then wonder why the edge came up on factory defaults -- which is EXACTLY the
day lost on 2026-07-12. It was never corrected at the source. Now it is. Its WAN_IF/LAN_IF
"chicken-and-egg" discussion is moot for the same reason: that problem only exists if you try to
seed a full config before first boot, and D-112(c) measures vtnetN AFTER boot.

Changelogs deliberately NOT touched -- they are history, not instructions. Marking history is
noise; marking instructions is safety.

Verification: opnsense-render-config 24 PASS, opnsense-build-config-iso 2 PASS, opnsense-api
21 PASS; repo-lint 0 fail.

STILL OPEN (the actual D-113(a2) migration): reduce the template to a minimal bootstrap, retire
the config-ISO path and the opnsense-edge module's config_seed/cdrom wiring, and rewrite Stage 3's
edge steps around the API. This sweep makes the repo SAFE, not FINISHED.

Revert: git revert this commit (restores the previous, dangerous instructions verbatim).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B6Fzre1CxCY8tzwFCudu57