fix: ashburn relay playbooks and document DZ tunnel ACL root cause

Playbook fixes from testing:
- ashburn-relay-biscayne: insert DNAT rules at position 1 before
  Docker's ADDRTYPE LOCAL rule (was being swallowed at position 3+)
- ashburn-relay-mia-sw01: add inbound route for 137.239.194.65 via
  egress-vrf vrf1 (nexthop only, no interface — EOS silently drops
  cross-VRF routes that specify a tunnel interface)
- ashburn-relay-was-sw01: replace PBR with static route, remove
  Loopback101

Bug doc (bug-ashburn-tunnel-port-filtering.md): root cause is the
DoubleZero agent on mia-sw01 overwrites SEC-USER-500-IN ACL, dropping
outbound gossip with src 137.239.194.65. The DZ agent controls
Tunnel500's lifecycle. Fix requires a separate GRE tunnel using
mia-sw01's free LAN IP (209.42.167.137) to bypass DZ infrastructure.

Also adds all repo docs, scripts, inventory, and remaining playbooks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

inventory/biscayne.yml

@@ -0,0 +1,14 @@
+all:
+  hosts:
+    biscayne:
+      ansible_host: biscayne.vaasl.io
+      ansible_user: rix
+      ansible_become: true
+
+      # DoubleZero identities
+      dz_identity: 3Bw6v7EruQvTwoY79h2QjQCs2KBQFzSneBdYUbcXK1Tr
+      validator_identity: 4WeLUxfQghbhsLEuwaAzjZiHg2VBw87vqHc4iZrGvKPr
+      client_ip: 186.233.184.235
+      dz_device: laconic-mia-sw01
+      dz_tenant: laconic
+      dz_environment: mainnet-beta

inventory/switches.yml

@@ -0,0 +1,23 @@
+all:
+  children:
+    switches:
+      vars:
+        ansible_connection: ansible.netcommon.network_cli
+        ansible_network_os: arista.eos.eos
+        ansible_user: install
+        ansible_become: true
+        ansible_become_method: enable
+      hosts:
+        was-sw01:
+          ansible_host: 137.239.200.198
+          # Et1/1: 64.92.84.81 (Ashburn uplink)
+          # Et4/1: 172.16.1.188 (backbone to mia-sw01)
+          # Loopback100: 137.239.194.64/32
+          backbone_ip: 172.16.1.188
+          backbone_peer: 172.16.1.189
+          uplink_gateway: 64.92.84.80
+        mia-sw01:
+          ansible_host: 209.42.167.133
+          # Et4/1: 172.16.1.189 (backbone to was-sw01)
+          backbone_ip: 172.16.1.189
+          backbone_peer: 172.16.1.188