fix(dns): repoint irv-ml1.nh3.internal to live Irvine LAN IP over mesh

The A record and the CLAUDE.md fleet row both still named 10.100.79.3,
the wg0 lifeline that went dormant in the headscale cutover — so the
name resolved to a dead door and the row read like an outage waiting to
be misdiagnosed.

- dns/internal.yaml: irv-ml1 10.100.79.3 -> 10.6.110.50 (Irvine's real
  LAN, 10.6.110.0/24, advertised fleet-wide as a mesh subnet route).
  Resolve to the LAN IP to match the host->LAN-IP model every other
  entry uses; mesh node IP 100.64.0.6 recorded in the note. Comment
  rewritten: Irvine is no longer numbered out of NH3's 10.100.79.0/24.
- CLAUDE.md: fleet-table row and GPU-placement rule updated to the mesh
  reality (wg0 lifeline dormant, access via headscale mesh).

Verified: all three AdGuard resolvers (ana/esh/nh3) return 10.6.110.50;
name pings live ~11ms; reachable from a mesh node and from a colo host
behind a subnet router.

CLAUDE.md

@@ -206,7 +206,7 @@ Observed and standardized across servers:
 | Name | IP | Site | Role | Details |
 |------|-----|------|------|---------|
 | ana-ml2 | 10.250.50.54 | Anaheim (`10.250.0.0/16`) | GPU / AI inference (bare metal, dual RTX PRO 6000 Blackwell Max-Q, 96 GB each) | `servers/ana-ml2/README.md` |
-| irv-ml1 | 10.100.79.3 (WG) | Irvine — reachable only via WireGuard tunnel from NH3 | GPU / AI inference (bare metal, RTX 3090 + RTX A6000, native stacks) | `servers/irv-ml1/README.md` |
+| irv-ml1 | 100.64.0.6 (headscale mesh); 10.6.110.50 (Irvine LAN, routed via mesh) | Irvine — via headscale mesh; wg0 lifeline (10.100.79.3) dormant post-cutover | GPU / AI inference (bare metal, RTX 3090 + RTX A6000, native stacks) | `servers/irv-ml1/README.md` |
 | ana-docker | 10.250.50.70 | Anaheim | General-purpose Docker host (non-GPU VM on pfi-pve) | `servers/ana-docker/README.md` |
 | pfi-ana-webhost | 10.250.50.52 | Anaheim | VM on pfi-pve (VMID 110) — web workload | `servers/pfi-ana-webhost/README.md` |
 | ana-filebot | 10.250.50.53 | Anaheim | LXC on pfi-pve (CT 112) — file-task automation | `servers/ana-filebot/README.md` |
@@ -235,7 +235,8 @@ Observed and standardized across servers:
 **Placement rules:**
 - GPU-required stacks → `ana-ml2` (primary, Anaheim) or `irv-ml1`
   (secondary, Irvine — bigger VRAM ceiling at 72 GB total). Access
-  to `irv-ml1` requires WireGuard.
+  to `irv-ml1` is via the headscale mesh (the wg0 tunnel lifeline is
+  dormant post-cutover; `10.100.79.3` no longer answers).
 - Anaheim non-GPU services → `ana-docker`.
 - NH-site non-GPU services → `nh3-docker`.
 - ESH home-lab workloads (`esteban.net`) → `esh-docker-vm` (general) or `vm-esh-nas` (needs direct NFS mounts from 10.0.50.50). Not part of the PFI colo topology, but shares monitoring/backup tooling.

dns/internal.yaml

@@ -82,10 +82,14 @@ hosts:
   - {name: nh3-pve,          site: nh3, v4: 10.100.250.60,  note: Proxmox hypervisor}
   - {name: pbs-nh3,          site: nh3, v4: 10.100.50.90,   note: Proxmox Backup Server — DR mirror}
   - {name: nh3-gw,           site: nh3, v4: 10.100.0.1,     note: UniFi UDM Pro SE — gateway + controller}
-  # Irvine is not its own zone: irv-ml1 is reachable only through NH3's
-  # WireGuard tunnel and is numbered out of NH3's 10.100.79.0/24, so it is
-  # named under nh3. Revisit if Irvine ever becomes a site in its own right.
-  - {name: irv-ml1,          site: nh3, v4: 10.100.79.3,    note: GPU host (Irvine, via WG) — 3090 + A6000}
+  # Irvine is not its own DNS site: it is a single box (irv-ml1) reached over
+  # the headscale mesh, so it is named under nh3 rather than getting its own
+  # resolver. Its real LAN is 10.6.110.0/24 (Irvine), advertised fleet-wide as
+  # a mesh subnet route — NOT NH3's 10.100.79.0/24 (that wg0 lifeline is
+  # dormant post-cutover 2026-09-06). The mesh node IP is 100.64.0.6; we resolve
+  # to the LAN IP to match the host→LAN-IP model every other entry uses.
+  # Revisit if Irvine ever grows beyond this one host.
+  - {name: irv-ml1,          site: nh3, v4: 10.6.110.50,    note: GPU host (Irvine, via headscale mesh) — 3090 + A6000; mesh node 100.64.0.6}
 
   # ---- esh: ESH home lab ----
   - {name: esh-docker-vm,    site: esh, v4: 10.0.50.45,     note: general-purpose docker host + AdGuard}