D-129 partial-rule: adopt VR1 edge plugin profile + pin the rest at deploy steps ...

Operator directive 2026-07-18 ("install the recommendations + pin the rest").
Doc/runbook-only; the LIVE install is operator-gated (auto-mode classifier
blocked the agent POST) and pending verification -- no cloud mutation here.

- D-129 PARTIALLY RULED (status line kept OPEN so ledger-scan still tracks the
  4 sub-decisions: COS-edge scope, os-frr, os-tailscale, edge-NTP). VR1 profile
  {os-qemu-guest-agent, os-iperf} adopted; pinned-at-steps mapping added.
- dc-dc-phase2 (DC-edge section): pin the VR1 profile at edge bring-up + build
  the reusable opnsense-api profile-installer there.
- dc-dc-phase6 Step 10: pin os-node_exporter gated on the COS-edge scope call.
- vr1-office1-as-built: FreeBSD base 14.3->15.1 recorded; directed plugins noted.
- session-ledger + machine block synced.

Revert: git revert this commit; nothing was installed/applied on the cloud.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz

Ledger+D-129: OPNsense 26.7 edge review + version drift + key-push record ...

Doc-only recording (nothing installed/applied on the live cloud):
- docs/opnsense-edge-addon-review-20260718.md (NEW): full 104-plugin catalog
  review of office1-opnsense @ 26.7, sorted by minimize-delta-to-Roosevelt.
  Findings: os-git-backup installed but UNCONFIGURED (no backup running).
- D-129 (PROPOSED): edge plugin/add-on base profile; operator rules buckets.
- vr1-office1-as-built.md: edge version drift 26.1.11 -> 26.7 recorded.
- session-ledger.md: 26.7 update + review note; operator personal key pushed
  to the 3 Office1 Linux VMs + edge (GUI, durable); machine-block re-seeded
  (next-free D=130, D-129 PROPOSED).

Revert: delete the review doc + D-129 entry; revert the as-built/ledger notes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JUBUyinU4sBAT4HV1b9vSz