docs(spikes): report OVN dataplane and lifecycle failures

[jmgilman]

Verdict

NOT SMOOTH, based only on steps 5–7:

• First pass succeeded: cross-member ping, HTTPS egress, Tailscale forward, SNAT .64, MTU 1442, and hash-checked 100 MB transfers both ways. Existing traffic survived central being stopped.
• Central-down network creation timed out at 60 seconds and left an Errored resource; central restart alone did not make a fresh same-name creation possible.
• After full teardown, the repeat restored cross-member ping but failed gateway/DNS/HTTPS egress. No manual network repair was applied; it did not reach forward/transfer checks.

Deliverables

• README with measurements, failed attempts, address consumption (two external IPv4 addresses per sandbox with one typical forward listen address), reboot evidence, and explicit Phase 5 sequencing rule.
• Runnable connectivity/100 MB probe and disposable topology helper, plus command/output JSONL records. Unrelated process listings and public trust material are explicitly redacted.
• Corrects 03b: macvlan is not an OVN uplink and cannot carry the requested OVN keys. Image-build moved to an independent NAT bridge, not OVN or physical passthrough.
• Existing image boot smoke passed all six checks, with central up and down; bridge HTTPS egress passed in both states. Shared router image/alias preserved.

Retained state

Central remains running/enabled on sandbox01; all four chassis remain enabled; NB is consistently TCP; physical fast40-uplink retains the reserved .64–.79 range. Disposable project/resources and build fixtures removed. Never unset NB or disable chassis for cleanup; Phase 5 must repoint NB first.

Fleet: https://github.com/GilmanLab/fleet/pull/14 (CI passed; final live dry-runs no diff)
Address plan: GilmanLab/root#30 (documentation build passed)
Upstream unset reproduction: lxc/incus#3948 (comment)

No networking or design-draft changes. No automatic merge.