docs(adr): two ADRs claimed 0041 — renumber the second to 0042

[Gerrrt]

What changed

The remote-path ADR is renumbered 0041 to 0042, and every reference to it
follows. The CRS326 ADR keeps 0041. Two stale counted claims in README.md
are corrected in the same commit.

No ADR prose is edited. ADR-0001 makes these immutable once accepted, and a
number is not an argument — inside the renamed file the only change is the
number in its H1.

Why

#491 and
#495 merged 56 seconds apart
on 2026-09-17 and both numbered their ADR 0041. check_docs.py catches
exactly this and says to renumber the one that landed second; the first-parent
history settles which without ambiguity:

ADR-0041	Merged via	At
…run-the-crs326-on-routeros…	#491	16:27:56
…terminate-the-remote-path…	#495	16:28:52

main has been failing check_docs.py by itself since then, so every open
pull request inherits a red Validate configs on a fault that is not its own.
Four were open when this was written (#493, #497, #500, #501). Confirmed by
checking out origin/main alone, with no feature branch present.

The references were the actual work

The rename is mechanical. The references are not, because a bare ADR-0041 in
prose does not say which ADR it means, and both are referenced widely. The
link-carrying references were retargeted mechanically; each remaining bare
mention was read in context and moved on what it is about, not on where it
sits:

• open-the-remote-path.md, eight mentions — that runbook is the remote path
  end to end, and names neither the CRS326 nor RouterOS anywhere.
• restore-the-firewall.md, two — both read "ADR-0041's tunnel" / "ADR-0041's
  rules", about the WireGuard peers.
• ADR-0011 — "from ADR-0041 onward, on a tunnel that terminates on VLAN 30".
• ADR-0014 — "what ADR-0041 adds to this segment is a second source subnet —
  172.31.0.0/24, the WireGuard peers".
• roadmap.md — the Guacamole decline, whose closing sentence contrasts itself
  against the remote-access answer named in the preceding clause.

Everything still reading ADR-0041 afterwards was re-checked and is the
switch: swap-the-switch.md throughout, ADR-0018, and the hardware.md and
roadmap.md rows that link the CRS326 file.

This is the part worth reviewing — a reference moved the wrong way would point
a reader at a decision about a switch when they wanted one about a tunnel, and
no check can catch that.

Blast radius

• No change to network segmentation or firewall rules
• No new port published to a VLAN that could not already reach the service
• No credential added outside secrets/*.sops.yaml

Documentation only. No rule, test, compose file or script is touched, so
nothing deploys.

Verification

• make validate passes
• Deployed to the lab and confirmed working — n/a, documentation
• Docs updated

python3 scripts/check_docs.py prints docs OK — 82 Prometheus + 18 Loki rules, 7 dashboards, 141 panels, 10 assertions and exits 0. The same command
on main at 3406525 reports the duplicate 0041 and both stale counts
(41 vs 42 ADRs, 26 vs 27 runbooks), which is the before-and-after this PR is
for. ./scripts/lint.sh passes all five linters, which is what covers the
relative links the rename touches.

🤖 Generated with Claude Code