Document pve-test's wifi-primary network and add Claude node guardrails

pve-test was briefly clustered with pve1 then deliberately de-clustered
so it could move to wifi-primary networking (4addr bridge mode, bonded
with a wired LAN backup) - a change not achievable while clustered given
corosync's latency requirements. Captures that as a reproducible script
plus docs: cluster separation procedure, the wifi network design and the
live-cutover pitfalls hit along the way, and node-role/history context.

Also adds CLAUDE.md guardrails for pve1 (production) vs pve-test
(sandbox) - this repo had none before, despite scripts here being able
to make real changes to both.

Separately: both nodes' mgmt firewalls were dropping ICMP by default
(TCP 22/8006 only), which looked like an outage mid-troubleshooting even
though SSH/web UI were fine. Added an explicit ping-allow rule to the
firewall template, applied it live on both nodes, and added an audit.sh
check so it stays enforced.

README.md

@@ -15,15 +15,22 @@ deferred).
   backed by Ceph. Needs dedicated hardware node 1 (`pve1`, an ASUS PN53 mini
   PC) doesn't have — see `docs/01-hardware-node1.md`.
 
+See `CLAUDE.md` for the guardrails Claude Code follows when working
+against these hosts (`pve1` is production and off-limits by default;
+`pve-test` is the sandbox).
+
 ## Repo layout
 
 - `docs/` — planning docs: hardware layout, storage migration, networking,
-  security hardening. Read `docs/00-overview.md` first.
+  security hardening, node roles. Read `docs/00-overview.md` first, then
+  `docs/05-node-roles.md` for what `pve1`/`pve-test` actually are.
 - `scripts/` — scripts to apply configuration on a node (SSH hardening, repo
-  switch, firewall, updates, etc). Idempotent, safe to re-run.
-  `scripts/bootstrap.sh` runs the full Stage 1 sequence end to end;
-  `scripts/audit.sh` verifies it (read-only). `scripts/lib/` holds shared
-  helpers (`common.sh`) sourced by the other scripts.
+  switch, firewall, updates, wifi/bond networking, etc). Idempotent, safe
+  to re-run. `scripts/bootstrap.sh` runs the full Stage 1 sequence end to
+  end; `scripts/audit.sh` verifies it (read-only).
+  `scripts/setup-wifi-bond-network.sh` reproduces `pve-test`'s wifi
+  network (see `docs/06-pve-test-wifi-network.md`). `scripts/lib/` holds
+  shared helpers (`common.sh`) sourced by the other scripts.
 - `config/` — reference config files/snippets to drop onto a node (firewall
   rules, sshd config, etc.).