docs(ovn): record durable fabric and lifecycle qualification

[jmgilman]

Changes

• Propose ADR-0006 for the durable OVN sandbox fabric; its status remains proposed, not accepted.
• Keep VLAN 40 and DHCP/routing unchanged, reserve .64-.127, and document the eight-sandbox budget: 24 addresses used and 40 headroom for the representative topology.
• Document isolated nat=false networks, snapshot recreation and DHCP identity consequences, application-scoped offline OVN trust, and fleet-owned renewal/recovery.
• Record the completed application, central-outage, lab03 reboot, natural dataplane recovery, and Errored-network reaper qualification.

Verification

• moon run docs:build passed in strict mode.
• Live application acceptance passed in 308.22 seconds.
• lab03 management returned after a 112-second outage; surviving traffic persisted and the rebooted guest recovered after one central start.
• A later reaper removed the Errored allocation and all owned residue in 3.03 seconds; fleet's eleven-operation dry run proposed no changes.

Companion state

• Encrypted replacement identities: GilmanLab/secrets#38.
• Public-only OpenTofu certificate metadata reconciliation remains blocked on the owner's AWS SSO login. The replacement trust is already active and verified; no private key enters OpenTofu.