SEC-031 CLOSED: dc1 edge rebuilt + procedure captured as runbook + tool ...

Rebuild the damaged dc1 OPNsense edge via the proven dc0 procedure (operator-
directed). dc-egress-check dc1 8/8; .6 region reaches the internet (ping 1.1.1.1,
curl images.maas.io 200) -- unblocks jammy image sync. Edge-only tofu -replace
(machine-asserted 2/0/2, nodes protected) -> console bootstrap -> WAN/LAN
addressing -> automatic outbound NAT.

Fix the root gap the operator flagged: the dc0 rebuild lived only as an audit
capture, forcing dc1 to reconstruct it. Now a first-class runbook
(runbooks/dc-edge-rebuild.md, site-parameterised) + a site-agnostic tool
(scripts/opnsense-console-rebuild.py, replaces per-DC one-off drivers). SEC-031
closed; CURRENT-STATE + changelog Item 4 updated. Also lands the Stage-5 dc1
region-standup captures (topology, DHCP handover).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

NetBox util-host importer + as-built utility hosts landed into office1-netbox ...

Close the tool gap on the operator-flagged NetBox-pending list: the D-134
utility RANGES were in the apex but no importer recorded the individual
utility-HOST addresses. New netbox/dc-util-hosts-import.py (DERIVES plane CIDRs
from lib-net + host octet from lib-hosts; whole-plan preflight; range
precondition; dns-collision guard; SANDBOX + upstream-write gates; dry-by-
default) + harness tests/dc-util-hosts-import/ (19/19).

Landed 8 ip-address objects (ids 187-194; apex ip-addresses 186->194, idempotent
re-run EXISTS/0): dc0 .5 juju-01, .6 maas-01, .7 tailscale-01; dc1 .6 maas-01
(both planes each). dns_name carries the ruled vr1-dc<N>-<role>-NN names -> dc0
renames recorded by construction.

Deferred as findings: the .4 artifact host (metal-admin-only, per-DC divergent,
no repo name -- needs an operator naming ruling) and dc1 .5/.7 (record when
live). Gauntlet ALL GREEN (102); repo-lint 0-fail/1-legacy-warn. Revert = NetBox
DELETE of ids 187-194. Body: changelog-20260807-dc1-region-sequence.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728