fix: ashburn relay playbooks and document DZ tunnel ACL root cause

Playbook fixes from testing:
- ashburn-relay-biscayne: insert DNAT rules at position 1 before
  Docker's ADDRTYPE LOCAL rule (was being swallowed at position 3+)
- ashburn-relay-mia-sw01: add inbound route for 137.239.194.65 via
  egress-vrf vrf1 (nexthop only, no interface — EOS silently drops
  cross-VRF routes that specify a tunnel interface)
- ashburn-relay-was-sw01: replace PBR with static route, remove
  Loopback101

Bug doc (bug-ashburn-tunnel-port-filtering.md): root cause is the
DoubleZero agent on mia-sw01 overwrites SEC-USER-500-IN ACL, dropping
outbound gossip with src 137.239.194.65. The DZ agent controls
Tunnel500's lifecycle. Fix requires a separate GRE tunnel using
mia-sw01's free LAN IP (209.42.167.137) to bypass DZ infrastructure.

Also adds all repo docs, scripts, inventory, and remaining playbooks.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/pane-exec.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+# Run a command in a tmux pane and capture its output.
+# User sees it streaming in the pane; caller gets stdout back.
+#
+# Usage: pane-exec.sh <pane-id> <command...>
+# Example: pane-exec.sh %6565 ansible-playbook -i inventory/switches.yml playbooks/foo.yml
+
+set -euo pipefail
+
+PANE="$1"
+shift
+CMD="$*"
+
+TMPFILE=$(mktemp /tmp/pane-output.XXXXXX)
+MARKER="__PANE_EXEC_DONE_${RANDOM}_$$__"
+
+cleanup() {
+    tmux pipe-pane -t "$PANE" 2>/dev/null || true
+    rm -f "$TMPFILE"
+}
+trap cleanup EXIT
+
+# Start capturing pane output
+tmux pipe-pane -o -t "$PANE" "cat >> $TMPFILE"
+
+# Send the command, then echo a marker so we know when it's done
+tmux send-keys -t "$PANE" "$CMD; echo $MARKER" Enter
+
+# Wait for the marker
+while ! grep -q "$MARKER" "$TMPFILE" 2>/dev/null; do
+    sleep 0.5
+done
+
+# Stop capturing
+tmux pipe-pane -t "$PANE"
+
+# Strip ANSI escape codes, remove the marker line, output the rest
+sed 's/\x1b\[[0-9;]*[a-zA-Z]//g; s/\x1b\[[?][0-9]*[a-zA-Z]//g' "$TMPFILE" | grep -v "$MARKER"