fix: ashburn relay playbooks and document DZ tunnel ACL root cause

Playbook fixes from testing:
- ashburn-relay-biscayne: insert DNAT rules at position 1 before
  Docker's ADDRTYPE LOCAL rule (was being swallowed at position 3+)
- ashburn-relay-mia-sw01: add inbound route for 137.239.194.65 via
  egress-vrf vrf1 (nexthop only, no interface — EOS silently drops
  cross-VRF routes that specify a tunnel interface)
- ashburn-relay-was-sw01: replace PBR with static route, remove
  Loopback101

Bug doc (bug-ashburn-tunnel-port-filtering.md): root cause is the
DoubleZero agent on mia-sw01 overwrites SEC-USER-500-IN ACL, dropping
outbound gossip with src 137.239.194.65. The DZ agent controls
Tunnel500's lifecycle. Fix requires a separate GRE tunnel using
mia-sw01's free LAN IP (209.42.167.137) to bypass DZ infrastructure.

Also adds all repo docs, scripts, inventory, and remaining playbooks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/shred-unwrap.py

@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+"""Strip IP+UDP headers from mirrored packets and forward raw UDP payload."""
+import socket
+import sys
+
+LISTEN_PORT = int(sys.argv[1]) if len(sys.argv) > 1 else 9100
+FORWARD_HOST = sys.argv[2] if len(sys.argv) > 2 else "127.0.0.1"
+FORWARD_PORT = int(sys.argv[3]) if len(sys.argv) > 3 else 9000
+
+sock_in = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+sock_in.bind(("0.0.0.0", LISTEN_PORT))
+
+sock_out = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+
+count = 0
+while True:
+    data, addr = sock_in.recvfrom(65535)
+    if len(data) < 28:
+        continue
+    # IP header: first nibble is version (4), second nibble is IHL (words)
+    if (data[0] >> 4) != 4:
+        continue
+    ihl = (data[0] & 0x0F) * 4
+    # Protocol should be UDP (17)
+    if data[9] != 17:
+        continue
+    # Payload starts after IP header + 8-byte UDP header
+    offset = ihl + 8
+    payload = data[offset:]
+    if payload:
+        sock_out.sendto(payload, (FORWARD_HOST, FORWARD_PORT))
+        count += 1
+        if count % 10000 == 0:
+            print(f"Forwarded {count} shreds", flush=True)