Mark lesson_route_health_flush_hang resolved (bulk flush + 3m window shipped,
deployed, timer re-enabled). Add lesson_vici_socket_acl_for_telegraf: the ikev2
churn root cause (check-vpn-status.sh as telegraf can't read the vici socket ->
false vpn_status=0), why the sudoers approach is blocked on ALT (sudo is
4710 root:wheel), and the vici-socket ACL fix. Add objects/igw.md changelog.
Co-Authored-By: Claude <noreply@anthropic.com>