geneve-over-v6 root-caused (bracket bug) + LIVE-CONFIRMED; executable encap gate + phase-04 fix ...

Live diagnosis on vr1-dc0 (D-138): the v6 geneve tunnel failed with ofport -1 because ovn-chassis 24.03 sets ovn-encap-ip BRACKETED ([2602:...]), which OVS geneve rejects. Delivered unbracketed -> tunnel instantiates -> real VM->VM cross-compute ping over geneve-over-IPv6 = 8/8, 0% loss. So v6-only data-tenant is viable and v4-forced is off the table (OVS 3.3.0/OVN 24.03.2/kernel 5.15). A first same-day test wrongly concluded 'v6 broken' from an OVN localport source (never tunnels by design) -- retracted.

scripts/geneve-encap-assert.sh (+ harness 16/16, manifest pinned): asserts C1 encap family consistency (--expect-family v6) AND C2 every geneve tunnel ofport>=0 (the bracket-bug check a family-only gate misses). phase-04 Step 12.2 rewritten (family-only -> family+tunnel-health, ULA->GUA) + Step 6 caveat. CURRENT-STATE section 1 + root-cause record updated; GUA-carve proposal (DC1 gap + matrix + scan) added. repo-lint 0-fail; gauntlet ALL GREEN (103).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728