DNS single-source Phase 1 + decommission Tailscale fleet-wide

Phase 1 of the DNS-redundancy cleanup (keep NetBird, collapse toward one
zone) — the safe, mesh-independent half:

- Every homelab LXC now resolves via Technitium (192.168.8.2). Fixed 8
  boxes on a dead resolver (.180), the router (.1), or Tailscale MagicDNS
  (100.100.100.100): 101,102,104,105,106,114,119,126.
- Removed the redundant /etc/hosts auth/mcp/secrets overrides (Technitium
  returns identical-or-better answers); disabled hubris-hosts-override.
- Net effect: on-prem DNS (LXCs + household via Fritz!Box->Technitium) is
  now NetBird-independent, so dropping the managed zone later can't break
  on-LAN resolution. Phases 2-4 still pending.

Tailscale decommissioned (was legacy/being-phased-out):
- Removed from the 6 LXCs still running it (101,103,104,105,114,119):
  logout, disable tailscaled, apt purge, state cleared.
- inventory.yaml: dropped tailscale from accepted + all mesh blocks;
  regenerated hosts/*.yaml (also pruned orphan authentik/claudio-bot).
- Tightened secrets-issuance MESH_SUBNETS: removed the now-vestigial
  Tailscale CGNAT range 100.64.0.0/10.
- Updated narrative docs (mesh, dns, network, README, AGENTS,
  agent-enrollment, homelab-context, 105-apps, 107-dns).

Live infra changed on the fleet + Mac; this commit records the docs/inventory.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

inventory.yaml

@@ -11,8 +11,8 @@
 #     ("external" is reserved for hosts the homelab CLI manages via ssh but
 #      that aren't homelab clients themselves — e.g. the IONOS netbird VPS
 #      with no /etc/age/key.txt and no /opt/homelab-context clone.)
-#   - `mesh:` lists addresses the host is reachable at. Both `netbird` and
-#     `tailscale` are accepted during the migration (see infrastructure/mesh.md).
+#   - `mesh:` lists addresses the host is reachable at via `netbird`.
+#     (Tailscale was decommissioned 2026-06-21 — see infrastructure/mesh.md.)
 #     Prefer netbird FQDNs over raw IPs.
 #   - `age_pubkey:` provisioned by secrets-issuance on first bootstrap and
 #     committed back via `homelab client add --finalize-pubkey <key>`.
@@ -32,7 +32,6 @@ mesh:
   primary: netbird
   accepted:
   - netbird
-  - tailscale
   netbird_subnet: 100.122.0.0/16
   netbird_domain: netbird.selfhosted
 services:
@@ -125,9 +124,6 @@ hosts:
     role: media-server
     lan_ip: 192.168.8.206
     public_host: media.hubris.network
-    mesh:
-      tailscale:
-        fqdn: jellyfin
     mounts:
     - /mnt/library
     age_pubkey: ''
@@ -146,9 +142,6 @@ hosts:
     role: document-archive
     lan_ip: 192.168.8.130
     public_host: paperless.hubris.network
-    mesh:
-      tailscale:
-        fqdn: paperless
     mounts:
     - /mnt/library
     age_pubkey: ''
@@ -161,9 +154,6 @@ hosts:
     lan_ip: 192.168.8.121
     public_host: git.hubris.network
     backend_port: 3000
-    mesh:
-      tailscale:
-        fqdn: gitea
     mounts:
     - /mnt/library
     notes:
@@ -178,10 +168,6 @@ hosts:
     lan_ip: 192.168.8.205
     public_hosts:
     - artifacto.hubris.network
-    mesh:
-      tailscale:
-        ip: 100.121.171.122
-        fqdn: apps
     mounts:
     - /mnt/library
     runs:
@@ -198,9 +184,6 @@ hosts:
     role: file-sync
     lan_ip: 192.168.8.224
     public_host: cloud.hubris.network
-    mesh:
-      tailscale:
-        fqdn: nextcloud
     mounts:
     - /mnt/library
     age_pubkey: ''
@@ -212,9 +195,6 @@ hosts:
     role: matrix-server
     lan_ip: 192.168.8.239
     public_host: matrix.hubris.network
-    mesh:
-      tailscale:
-        fqdn: elementsynapse
   sophia:
     kind: lxc
     pve_id: 119
@@ -222,9 +202,6 @@ hosts:
     os: linux
     role: workshop
     lan_ip: 192.168.8.109
-    mesh:
-      tailscale:
-        fqdn: sophia
     mounts:
     - /mnt/library
     age_pubkey: ''
@@ -236,9 +213,6 @@ hosts:
     role: photo-management
     lan_ip: 192.168.8.136
     public_host: photos.hubris.network
-    mesh:
-      tailscale:
-        fqdn: muleimage
     mounts:
     - /mnt/library
     age_pubkey: ''
@@ -266,9 +240,6 @@ hosts:
     - jellyseerr.hubris.network
     - qbit.hubris.network
     - sab.hubris.network
-    mesh:
-      tailscale:
-        fqdn: arr
     mounts:
     - /mnt/library
     age_pubkey: ''
@@ -299,9 +270,6 @@ hosts:
     os: linux
     role: home-automation
     lan_ip: 192.168.8.101
-    mesh:
-      tailscale:
-        fqdn: homeassistant
   republic-laptop:
     kind: workstation
     os: linux