fix(vyos): restore physical lab routing

[jmgilman]

Summary

• allow ICMP gateway-health probes from rtr01's transit address
• keep the RouterOS 10.10.0.0/16 via 10.0.0.2 route active
• add a regression assertion for the tracked VyOS policy

Validation

• moon run network:check: 41 tests plus format, lint, typing, lock, and template validation
• synchronized and saved the corrected configuration on gw01
• rtr01 route changed from inactive to active and its gateway probe has 0% packet loss
• physical VLAN gateway ping and direct LAN SSH to sandbox01 succeeded with accepted Tailscale routes disabled
• Tailscale routes were restored and Tailscale SSH still succeeds