Astra: review region HA spec 2 (two-box regions), rev 1

Spec: docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md on branch design-region-ha-two-box. It builds on spec 1 (docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md), whose code is on main and dormant.

Paul's rulings H1 to H24, and the section choices in §2, are settled. Don't reopen them. Judge whether the design achieves them safely, against the code on main.

Focus areas:

1. Safety under the claim. - Can two boxes in a region ever run the same instance, or let a stale local copy win? - Is §8's list of single-box assumptions complete? Grep main for others.
2. Boot and enrolment (§5). - Can a box take instances before it's hardened, configured or enrolled? - Is H16's confirmation sound with the new read-only Auto Scaling describe? - Is the SSM and KMS scope tight enough, given the host_buckets statements and the existing SSM Deny in infra/modules/region-host/main.tf?
3. Ingress (§6). - Is the NLB health answer correct and narrow? - Do private-address forwarding and platform-route forwarding work with internal/edge/homemap.go and edge.go's single-hop backhaul? - Does anything break when the region's EIP moves to an NLB: GeoIP, rate limits, the IMDS public-ipv4 that edges files publish, certificate issuance, or the domain check?
4. Placement (§7). - Are the eligibility rules and the unplaced state consistent with internal/boxchoice and internal/hostops/executor.go? - Is unplaced representable in the claim's create intent without breaking recovery?
5. Rollout (§9). - Is the EIP cut-over sequence correct for AWS: an NLB subnet-mapping EIP can be set only at creation? - Is the rollback real? - Does the old box keep serving correctly as an NLB target?
6. Failure modes (§10). Is anything missing or wrong?
7. The open questions in §13.

Give findings P1/P2/P3 with file:line, each with a concrete failure scenario. End with a verdict: ready for a plan, or not.