Non-secret identity, a reproducible capacity observation, and host-ops
labor/exit inputs for resource:hosteurope:railiance01. Booked price and
contract dates stay unknown for their owners.
Make the k3s API tunnel-only (ADR-005), stop declaring Flannel VXLAN
open to Anywhere, tag the base role so firewall can be scoped, and
schedule the Goss declared-vs-live check. CoulombCore sets ufw_manage
false so a converge cannot enable UFW there. T02 still needs operator
approval for make converge-firewall HOST=Railiance01.
