OK: maas snap 3.7.2-17972-g.35e297c4d (3.7/stable)
OK: MAAS rackd running
OK: enrolled to region http://10.10.0.20:5240/MAAS
== node-host (Model B) readiness ==
  [ok] libvirt/qemu installed
  [ok] nested KVM ON (kvm_amd)
  [ok] jessea123 in libvirt group
  [ok] inner pool dir /var/lib/libvirt/vr1-dc0-inner
  [ok] opnsense base /var/lib/libvirt/vr1-dc0-inner/opnsense-26.7-nano.qcow2
  [ok] SEC-010 transit FORWARD-drop present + transit interface 'enp1s0' exists
  [ok] D-125 WAN bridge 'br-vr1-dc0-wan' present + uplink 'enp2s0' enslaved
  [gate] DEPLOY-TIME (unprovable here, like the depth-4 boot gate): before the OPNsense chain
         rides it, prove egress in ISOLATION -- attach a throwaway guest to 'br-vr1-dc0-wan',
         confirm it gets a vcloud-ISP address and pings out. FAIL => revert to the D-125
         double-NAT fallback, NOT a redesign.