feat(device-edge): retire superseded VPS tailnet

infra/deploy-runner/build-device-edge-vps-artifact.mjs

@@ -35,11 +35,12 @@ if (
     "backhaul",
     "relay",
     "core-channel",
+    "tailscale-retirement",
   ].includes(phase)
   || !/^[A-Za-z0-9._-]{1,96}$/.test(patchId || "")
 ) {
   throw new Error(
-    "usage: build-device-edge-vps-artifact.mjs <foundation|runtime-reconciliation|backhaul|relay|core-channel> <patch-id>",
+    "usage: build-device-edge-vps-artifact.mjs <foundation|runtime-reconciliation|backhaul|relay|core-channel|tailscale-retirement> <patch-id>",
   );
 }
 
@@ -92,6 +93,9 @@ const entriesByPhase = {
     "vps/systemd/nodedc-device-edge-channel.service",
     "deployment/device-edge-vps-core-channel-v1.json",
   ],
+  "tailscale-retirement": [
+    "deployment/device-edge-vps-tailscale-retirement-v1.json",
+  ],
 };
 const entries = entriesByPhase[phase];
 const ignoredBasenames = new Set([".DS_Store", ".git", "node_modules"]);
@@ -151,7 +155,7 @@ try {
     entries,
     publicIngress: phase === "relay"
       ? "tcp/9921"
-      : phase === "core-channel"
+      : ["core-channel", "tailscale-retirement"].includes(phase)
         ? "tcp/443-mtls-only"
         : "disabled",
     commandTransport: "disabled",
@@ -289,6 +293,27 @@ async function assertBoundary() {
       }
     }
   }
+  if (phase === "tailscale-retirement") {
+    for (const required of [
+      '"predecessorPatch": "device-edge-vps-core-channel-20260812-010"',
+      '"runtimeAction": "stop-disable-remove-userspace-tailscale-runtime-state-and-superseded-trust"',
+      '"trackerIngress": "disabled"',
+      '"externalRevocation": "delete-exact-nodedc-b2-vps-machine-in-tailnet-after-deploy-ok"',
+    ]) {
+      if (!combined.includes(required)) {
+        throw new Error(`tailscale_retirement_boundary_missing:${required}`);
+      }
+    }
+    for (const forbidden of [
+      "tcp dport 9921",
+      "LocalForward",
+      "commandTransport\": \"enabled",
+    ]) {
+      if (combined.includes(forbidden)) {
+        throw new Error(`tailscale_retirement_boundary_violation:${forbidden}`);
+      }
+    }
+  }
 }
 
 function canonicalTarScript() {