Complete procedures with a way back.

Build a tagged Ubuntu Tailscale router, advertise and approve a private subnet, authorize users with least-privilege grants, test optional internet egress, and rehearse failure, withdrawal, and replacement.

Prove Cilium health and enforcement, build a portable default-deny baseline, restore exact DNS and application flows, observe allow and drop verdicts with Hubble, add one optional Cilium-specific FQDN rule, and roll out with reversible SLO gates.