fix(docs): mask Tailscale IPs with placeholder variables

Replace live 100.x IPs with , ,
 across docs and agent skills.

---
Build: pass | Tests: FAIL — 1 failed

.agent/skills/network-throughput/SKILL.md

@@ -29,14 +29,14 @@ Record these before the run so there is no ambiguity:
 - `client network`: house Wi-Fi | hotspot | wired | other
 - `server`: osa.smilepowered.org
 - `server public IP`: 51.83.197.148
-- `server Tailscale IP`: 100.72.229.63
+- `server Tailscale IP`: ${OSA_TS_IP}
 - `URL`: exact image URL under test
 - `downloader`: curl or wget only; prefer curl with `--http1.1`
 
 Terminology:
 
 - "osa hotspot" means the phone hotspot/mobile Wi-Fi path.
-- "osa server" means `osa.smilepowered.org`, FreeBSD 15, public `51.83.197.148`, Tailscale `100.72.229.63`.
+- "osa server" means `osa.smilepowered.org`, FreeBSD 15, public `51.83.197.148`, Tailscale `${OSA_TS_IP}`.
 
 ## Safety Rules
 
@@ -62,7 +62,7 @@ SERVER_IF="vtnet0"
 SERVER_DIR="/home/clawdie/clawdie-iso/tmp/network-tests/$TEST_ID"
 CLIENT_IP="<debby-public-ip-if-known>"
 SERVER_IP="51.83.197.148"
-SERVER_TS_IP="100.72.229.63"
+SERVER_TS_IP="${OSA_TS_IP}"
 DURATION_SEC="600"
 ```
 
@@ -78,7 +78,7 @@ CLIENT_DIR="$HOME/.local/state/hermes/net-tests/$TEST_ID"
 URL="https://osa.smilepowered.org/downloads/iso/clawdie-xfce-operator-usb-fbsd15.0-amd64-15.maj.2026.img.gz"
 SHA_URL="$URL.sha256"
 SERVER_IP="51.83.197.148"
-SERVER_TS_IP="100.72.229.63"
+SERVER_TS_IP="${OSA_TS_IP}"
 DURATION_SEC="600"
 ```
 
@@ -204,7 +204,7 @@ Start this on debby before the download and stop it after the download stops. It
   GW=$(ip route show default | awk '{print $3; exit}')
   while true; do
     date -u '+utc=%Y-%m-%dT%H:%M:%SZ'
-    for t in "$GW" 1.1.1.1 "$SERVER_TS_IP" 100.103.255.41; do
+    for t in "$GW" 1.1.1.1 "$SERVER_TS_IP" ${DOMEDOG_TS_IP}; do
       echo "### $t"
       ping -c 5 -i 0.2 -W 2 "$t"
     done
@@ -467,7 +467,7 @@ Client: debby
 Client network path: house Wi-Fi | hotspot | wired | other
 Server: osa.smilepowered.org
 Server public IP: 51.83.197.148
-Server Tailscale IP: 100.72.229.63
+Server Tailscale IP: ${OSA_TS_IP}
 URL:
 Downloader: curl --http1.1 | wget | other
 Parallel downloads: no | yes, describe
@@ -519,7 +519,7 @@ We want one clean HTTPS download from osa.smilepowered.org to debby, with no Fir
 
 Definitions:
 - “osa hotspot” means phone hotspot/mobile Wi-Fi path.
-- “osa server” means osa.smilepowered.org, FreeBSD 15, public 51.83.197.148, Tailscale 100.72.229.63.
+- “osa server” means osa.smilepowered.org, FreeBSD 15, public 51.83.197.148, Tailscale ${OSA_TS_IP}.
 
 Rules:
 1. Start pcaps on both sides before the download.

doc/INTERAGENT-RUN-CONTRACT.md

@@ -178,7 +178,7 @@ scp root@osa.smilepowered.org:/home/clawdie/clawdie-iso/tmp/network-tests/$TEST_
 Or over Tailscale SSH/IP:
 
 ```sh
-scp root@100.72.229.63:/home/clawdie/clawdie-iso/tmp/network-tests/$TEST_ID/osa-vtnet0-https-90s.pcapng .
+scp root@${OSA_TS_IP}:/home/clawdie/clawdie-iso/tmp/network-tests/$TEST_ID/osa-vtnet0-https-90s.pcapng .
 ```
 
 Use `rsync -e ssh` instead of `scp` for resumable larger transfers.

doc/NETWORK-SKILL-HANDOFF.md

@@ -145,7 +145,7 @@ losing post-download counters.
 
 **Fix:** Calculate capture timeout as `DURATION_SEC + 300`.
 
-### M6. Unexplained `100.103.255.41` / "domedog" IP
+### M6. Unexplained `${DOMEDOG_TS_IP}` / "domedog" IP
 
 **File:** `.agent/skills/network-throughput/SKILL.md:207,484`
 
@@ -155,7 +155,7 @@ in the Definitions section.
 **Fix:** Add to Definitions:
 
 ```markdown
-| DOMEDOG_TS_IP | 100.103.255.41 | Tailscale IP of third reference host |
+| DOMEDOG_TS_IP | ${DOMEDOG_TS_IP} | Tailscale IP of third reference host |
 ```
 
 ## LOW Priority