feat(vyos): manage gateway with pyinfra

[jmgilman]

Summary

• replace the legacy Ansible model with a version-controlled whole-config pyinfra workflow
• enforce accepted routing, VLAN, DHCP, firewall, CoreDNS, and Tailscale state on gw01
• verify before save, preserve the live VyOS footer, redact facts, and serialize local mutation

Validation

• mise exec -- moon run network:check --summary minimal
• live facts collection with redaction assertions
• successful full deployment to gw01
• successful second convergence run with PendingSave=False
• live authoritative and recursive DNS queries through gw01