feat(acl): admit GF Darwin worker route (TIN-2998)

[Jesssullivan]

Summary

Contributes to TIN-2998 under Linear carrier comments c89b99d0-3010-4b2d-b7cf-a93e46694f40 and 44df2310-7773-4987-8487-fc234dd8372c.

• adds exact typed tags tag:gf-reapi-cell-egress and tag:gf-reapi-darwin-worker
• permits Kubernetes operator ownership only for the cell-egress tag
• permits tag:tag-authority, never the Kubernetes operator, to assign the PZM worker tag
• adds exactly one grant from cell egress to the Darwin worker on tcp:8981
• contract-tests every ACL/grant reference to either tag so a wildcard, mixed-source, reverse, alternate-port, or legacy ACL route fails

This is the public tailnet ACL SSOT. It does not configure PZM, GF, or the owner overlay, and it makes no network-exclusivity claim while PZM retains tag:dollhouse; exact mTLS remains the authorization boundary.

Hard hold

SOURCE REVIEW ONLY. DO NOT READY OR MERGE.

Current .github/workflows/cd.yml publishes unconditionally on every main push after ignoring validation/dry-run failures. The referenced production environment is unprotected, tailnet-acl-production does not exist, and workflow 238207465 remains active.

Release this hold only after the independent hard prerequisites on #20 establish the governed publisher and the release is recorded on this PR. Do not repair or bypass CD in this branch. Merging this draft would be a live ACL mutation.

After release, TIN-2998 activation order remains: ACL policy -> PZM tag and mTLS readiness -> governed owner-overlay apply -> forced Darwin proof and rollback.

Evidence

• signed commits a04f1868759be886577015318f06a9ca796fbcfd and 5a0ad86ab0d690d4ecdd3822d7ec9ffd8eabbe09
• dhall format --check constants.dhall
• dhall format --check fragments/core.dhall
• jq -e . grants.json
• git diff --check
• adversarial review confirmed the policy itself is exact and identified the CD hold plus the now-repaired test bypass

No live validation, ACL publication, device-tag write, credential change, or runtime mutation occurred.

[github-actions]

⚠️ ACL Validation

Validation

tailnet-acl dev shell
  dhall:         1.42.3
  dhall-to-json: 1.7.12
  just:          just 1.46.0
Loading local policy from /home/runner/work/tailnet-acl/tailnet-acl/generated/policy.json ...
Fetching live ACL from taila4c78d.ts.net ...
API error 401: {"message":"API token invalid"}

Diff against live

tailnet-acl dev shell
  dhall:         1.42.3
  dhall-to-json: 1.7.12
  just:          just 1.46.0
Fetching live ACL ...
API error 401: {"message":"API token invalid"}

[Jesssullivan]

CI classification for run 31534013437: source Dhall type-check/build and secret detection passed. Live validation did not reach policy comparison; it failed with HTTP 401 API token invalid. This is credential/publisher custody evidence, not a policy-diff failure and not authority to remint or bypass. Draft/hard hold remains: repair through the governed #20 publisher ritual, then rerun exact-head validation before any readiness or merge.