R-50 island-bridge: SPIKED -> GO (probes P1-P8 pass live on t740 drill)

Provisioned nested-PVE drill 'drill-r50' (qm300 on demo-hp) via the v1.25.0
nested-vm ISO through the real day-0, then ran the R-50 empirical spike:
- vmbr9 portless island bridge + guest island NIC hot-add (LAN undisturbed)
- F1 replay money shot: LAN move survives on the island; LAN-literal bind
  reproduces the 2026-07-20 daemon-exit bug verbatim
- dnsmasq trap confirmed live + lan_resolver.host_ip fix proven
- pin address-independent (leaf SHA-256 unchanged, HTTP 200 over island)
- survival matrix: agent/guest/host-cold-reboot all return on the island

Docs: SPIKE verdict BLOCKED->GO, ROADMAP R-50 SPIKED->GO, nodes.md drill VM,
REPORT overwrite.

documentation/operations/nodes.md

@@ -65,14 +65,20 @@ No trace of `192.168.100.2` remains. `wg-felhom` `10.77.0.3/32` up to the hub. G
 them off DooPlex (the production k3s node). **This is a VM-HOSTING ruling only; the build-PIPELINE
 relocation to the t740 is NOT ruled or implemented here.**
 
-**Current state (verified 2026-07-25):** the ruling is **forward-looking and not yet realized.** The
-t740 hosts **no drill/build VM yet** — `qm list` is empty, `/etc/pve/qemu-server/` is empty, it is a
-standalone PVE node running only its own LXC guest 9201. The historical drill appliance is still
-`drill.qcow2` on **DooPlex** (`/mnt/5_hdd/felhom.eu/drill/`, ~18G, powered off — a golden-bake VM whose
-nested guest is purged after each bake). felhom-pve likewise has no drill VM. **A nested-PVE drill VM
-(agent + a nested guest) must be provisioned on the t740** before the R-50 island-bridge empirical spike
-(`audits/SPIKE-island-bridge-2026-07-25.md`) can run its P2–P7 probes — that spike is blocked on exactly
-this. The t740's ~30 GB RAM / ~49 GB free local-lvm suit it as the drill host.
+**Current state (updated 2026-07-25 PM):** the ruling is **realized** — the t740 now hosts the first
+drill appliance. **QEMU VM `300` = `drill-r50`**, a nested PVE-in-a-VM (8 GiB RAM, 4 vCPU cpu=host, 32 GiB
+local-lvm disk, OVMF/SB-off, one NIC on `vmbr0` DHCP). Installed from
+`felhom-pve-9.2-1-v1.25.0-nested-vm-generic-mkimage.iso` through the **real day-0** (self-register →
+operator bind to scratch customer `drill-r50` → deliver → nested guest **9201** provisioned, controller
+0.161.0 / agent 0.93.0 healthy). Its own break-glass root is vaulted in the hub
+`host_recovery/drill-r50-0a4f9a`; reach it as `root@192.168.0.176` **through `demo-hp`** (it has no key
+and no tailnet — it is a peer on demo-hp's LAN). It has snapshot **`r50pre`** (clean LAN-literal day-0).
+This VM was provisioned to unblock and run the **R-50 island-bridge empirical spike**
+(`audits/SPIKE-island-bridge-2026-07-25.md`) — **probes P1–P8 PASSED 2026-07-25, verdict GO**; the drill
+was left in its working island configuration. It is a throwaway: destroy with `qm stop 300 && qm destroy
+300 --purge 1` (and delete the `drill-r50` customer + appliance #9 hub-side) when no longer needed. The
+historical golden-bake `drill.qcow2` still lives on **DooPlex** (`/mnt/5_hdd/felhom.eu/drill/`, ~18G,
+powered off) and is unrelated. The build-PIPELINE relocation to the t740 remains unbuilt.
 
 ### Access — there is no baked SSH key