feat: kit-busrouter v2.0 — complete Synology + GL fleet router platform

Includes:
- package/ GL-XE3000 kit-busrouter (opkg)
- scripts/provision.sh (GL) and provision-synology.sh (Synology)
- syno-balance/ — new WAN balancer replacing aiwanbal (SmartWAN adapter)
- kit-connect/ — unified connectivity SPK (Tailscale + reverse SSH)
- docs/deployment/synology-rt2600ac-checklist.md — 62-point checklist
- docs/provisioning/device-identity.md — fleet identity spec
- docs/pilot/checklist.md — field pilot validation
- x4078_20260721.dss — reference config backup

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/diag/wg-mgmt-diagnose.sh

@@ -0,0 +1,47 @@
+#!/bin/sh
+# wg-mgmt-diagnose.sh — READ-ONLY diagnosis of the WG mgmt tunnel on the bench router.
+# Run ON THE ROUTER over LAN:  ssh root@192.168.8.1  (pw kitPLANE1!!), then: sh wg-mgmt-diagnose.sh
+# Safe: only reads state + captures packets. Mutates nothing.
+# Context: docs/handoff/2026-07-01-wg-mgmt-incident-and-resume.md
+set +e
+HUB_WG=10.88.0.1
+MGMT_SRC=10.88.0.2
+HUB_PUB=167.172.237.162
+
+echo "===== A. FULL WG state (THE missing datapoint — check persistent-keepalive + allowed-ips) ====="
+wg show
+echo
+echo "===== routing / policy (should steer mgmt-sourced traffic into table 1001) ====="
+echo "-- ip rule --";                 ip rule
+echo "-- table 1001 --";             ip route show table 1001
+echo "-- default routes --";         ip route show | grep -E '^default'
+echo "-- underlay path to hub --";   ip route get "$HUB_PUB"
+echo "-- mgmt-sourced return path --"; ip route get "$HUB_WG" from "$MGMT_SRC" 2>/dev/null
+echo "-- rp_filter (expect 0; NOT the cause) --"
+for f in /proc/sys/net/ipv4/conf/all/rp_filter /proc/sys/net/ipv4/conf/eth0/rp_filter \
+         /proc/sys/net/ipv4/conf/rmnet_mhi0/rp_filter /proc/sys/net/ipv4/conf/wgclient1/rp_filter; do
+  [ -f "$f" ] && echo "  $f = $(cat "$f")"
+done
+echo "-- iface MTUs --"
+for i in eth0 rmnet_mhi0 wgclient1; do ip link show "$i" 2>/dev/null | sed -n 's/.*\(mtu [0-9]*\).*/  '"$i"': \1/p'; done
+
+echo
+echo "===== B. Live capture: watch fiber(eth0) WG + decrypted(wgclient1) while pinging the hub ====="
+echo "     [eth0] = encrypted WG on the fiber underlay ; [wg] = decrypted inner packets"
+( timeout 12 tcpdump -ni eth0 udp port 51820 2>/dev/null | sed 's/^/[eth0] /' & )
+( timeout 12 tcpdump -ni wgclient1 2>/dev/null        | sed 's/^/[wg]   /' & )
+sleep 1
+ping -c 8 -W 2 -I "$MGMT_SRC" "$HUB_WG"
+echo "ping rc=$?"
+wait 2>/dev/null
+
+echo
+echo "===== INTERPRET ====="
+cat <<'EOF'
+  * wg show 'persistent keepalive: (none)'      -> hypothesis #1 (NAT mapping expiry). Fix: keepalive.
+  * hub-peer 'allowed ips' lacks 10.88.0.1       -> hypothesis #2. Replies get cryptokey-dropped.
+  * [eth0] shows OUTBOUND + INBOUND :51820        -> hub replies DO arrive on fiber -> decrypt/inner issue.
+  * [eth0] shows OUTBOUND only                     -> router pkts not leaving OR hub not returning -> coordinate hub capture.
+  * [wg] shows echo-request but no echo-reply      -> confirms replies not reaching inner iface.
+  Next: apply scripts/diag/wg-mgmt-fix.sh  (keepalive first). See the handoff doc.
+EOF