site-tailscale: advertise-only subnet router + authkey=file: + check guards ...

Fixes the 2026-08-07 install incident where bringing .7 up as a subnet router
with --accept-routes blackholed its own L3 (it imported a route sending its
own return traffic for the advertised /22 into tailscale0) and locked us out.

- install: DROP --accept-routes (a subnet router advertises, it does not need
  to consume routes); pass the pre-auth key via --authkey=file:<path> so the
  secret never lands on argv / in ps (the key leaked that way during the
  incident).
- check: add two assertions, each with a failing-direction fixture --
  own-subnet-not-routed-via-tailscale0 (the blackhole guard) and control-plane
  reachability (live HTTP from $LOGIN_SERVER, not just DNS).

Validated LIVE: advertise-only re-join brought .7 up Running/Online (TSIP
100.64.0.57) with its own subnet NOT hijacked and no lockout; route now awaits
Headscale approval. Harness 27/0, gauntlet ALL GREEN (102), repo-lint 0-fail.
Body: docs/changelog-20260807-dc0-tailscale-install.md (UPDATE section).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

site-tailscale: prep verb + untagged VR1 (office1-mirrored) + forwarding assertion ...

Extends scripts/site-tailscale.sh to three verbs (prep|install|check) so the
per-DC .7 subnet router is brought up exactly as the working Office1 router.

- prep <site>: install the tailscale .deb from a rack-staged copy ($TS_DEB;
  the .7 has no external egress) + enable IP forwarding (/etc/sysctl.d/
  99-tailscale.conf, sysctl --system) and ASSERT it took.
- tag now OPTIONAL: TS_TAG defaults empty = untagged (office1-mirrored, VR1);
  install omits --advertise-tags and adds --accept-routes (office1 RouteAll);
  TS_TAG=tag:subnet-router restores the D-129(iii) tagged design (Roosevelt).
- check now ASSERTS IP forwarding -- the load-bearing subnet-router property
  that 'tailscale up --advertise-routes' warns-and-succeeds without, so the
  route could be approved while nothing forwards to Horizon (advisor 2026-08-07).

Harness: 23/23 (new failing-direction fixtures prep-noforward, check-noforward,
check-tag-notag, prep-fromdeb, install-tag-happy). Gauntlet ALL GREEN (102);
repo-lint 0 fail.

Records the operator's untagged/office1-mirror deferral as a D-129(iii)
amendment ([OPS], tags/autoApprovers/star ACL -> bare-metal) with the verbatim
utterance. Body: docs/changelog-20260807-dc0-tailscale-install.md.

Live install NOT yet executed (staged .deb -> dpkg -> prep -> install ->
operator Headscale approval -> check).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728

site-tailscale.sh: node-side per-DC Tailscale subnet-router tool (+harness) ...

The NODE-SIDE half of the D-129(iii) per-DC operator-access build (rulings a-d):
runs ON the .7 subnet-router VM, advertises THIS DC's metal-admin /22 to the
tailnet with a TAGGED identity, SNAT on (default, ruling d), site-keyed like
dc-rack-net.sh (check/install, fails closed). Metal-admin CIDR per site is a
MEASURED table row (10.12.8.0/22 dc0 / 10.12.68.0/22 dc1) cross-checked against
the router's own .7 leg at runtime. Control plane tailscale.baldurkeep.com
(MEASURED). The Headscale-side prerequisites (tagged pre-auth key, autoApprovers
written BEFORE first advertise, star ACL) are control-plane work, deferred until
access -- the script fails closed without them.

Harness 15/15: every exit path (0/1/2/4) has a failing-direction fixture; the
happy-case fixtures caught a real jget quote-collision bug (bracket-key path
inside an eval string) that made the negative checks pass for the wrong reason.
gauntlet ALL GREEN (101); HARNESS-MANIFEST recorded 100->101; repo-lint 0 fail.

REVERT: git rm scripts/site-tailscale.sh && git rm -r tests/site-tailscale
  && bash scripts/run-tests-all.sh --record-manifest

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Fg98z7QyzwYUs8fsWCn728