ci: tripwire against lab addresses creeping back into tracked source

Cheap insurance, explicitly not the real check -- the semantic tests in
deployment_config.rs are what prove propagation, using two TEST-NET addresses
and bind != advertise. This grep only stops the lab subnet reappearing months
from now when the reasoning has been forgotten.

Deployment config legitimately contains real addresses and lives in gitignored
files, so it is never scanned. The frozen baseline doc is allowlisted BY PATH:
it records what a past deployment actually was, and rewriting it would falsify
the record.

Also swapped the lab IP for a TEST-NET placeholder in the usage examples and
error messages of compose/entrypoint/client_arm. Those were already correct
architecture -- every one requires the address via ${VAR:?} -- but using the
real lab IP as the example is the same 'happens to match our lab' smell, and
placeholders keep the tripwire allowlist near-empty.

Mutation-tested: adding a lab address to a source file makes it exit 1.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

fifa17-recon/docker/fifa17-python/client_arm.sh

@@ -20,12 +20,12 @@
 # after these first redirected contacts the game is handed <SERVER_IP> for every
 # later hop (Blaze main, roster, UTAS, telemetry) and dials the server directly.
 #
-# Usage:   sudo OPENFUT_SERVER=10.10.0.120 ./client_arm.sh
+# Usage:   sudo OPENFUT_SERVER=203.0.113.10 ./client_arm.sh
 #   (re-run after every reboot; the sysctl/iptables state is volatile)
 # ============================================================================
 set -euo pipefail
 
-SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 10.10.0.120}"
+SERVER="${OPENFUT_SERVER:?set OPENFUT_SERVER to the backend host IP, e.g. 203.0.113.10}"
 GOS_EA_IP="159.153.51.20"     # winter15.gosredirector.ea.com (hardcoded in FIFA17)
 
 if [ "$(id -u)" -ne 0 ]; then

fifa17-recon/docker/fifa17-python/docker-compose.yml

@@ -24,7 +24,7 @@ services:
       OPENFUT_BIND: "${OPENFUT_BIND:-0.0.0.0}"
       # Address advertised to the client for the next hop. MUST be this host's
       # LAN IP as seen from the game machine (105). Required (see .env.example).
-      OPENFUT_ADVERTISE: "${OPENFUT_ADVERTISE:?set OPENFUT_ADVERTISE in .env to this host's LAN IP, e.g. 10.10.0.120}"
+      OPENFUT_ADVERTISE: "${OPENFUT_ADVERTISE:?set OPENFUT_ADVERTISE in .env to this host's LAN IP, e.g. 203.0.113.10}"
       # POW content advertises port 8080 by default, which collides with the
       # openfut-core publish on this host. Remap it to 8085 on the host and
       # advertise the remapped endpoint.

fifa17-recon/docker/fifa17-python/entrypoint.sh

@@ -11,13 +11,13 @@
 # Address behaviour is driven by two env vars (see each responder):
 #   OPENFUT_BIND       bind address for every listener   (container: 0.0.0.0)
 #   OPENFUT_ADVERTISE  address handed to the client for the next hop
-#                      (the server's LAN IP, e.g. 10.10.0.120)
+#                      (the server's LAN IP, e.g. 203.0.113.10)
 # ============================================================================
 set -uo pipefail
 cd "$(dirname "$(readlink -f "$0")")/tools"
 
 BIND="${OPENFUT_BIND:-0.0.0.0}"
-ADV="${OPENFUT_ADVERTISE:?OPENFUT_ADVERTISE must be set to the server LAN IP (e.g. 10.10.0.120)}"
+ADV="${OPENFUT_ADVERTISE:?OPENFUT_ADVERTISE must be set to the server LAN IP (e.g. 203.0.113.10)}"
 export OPENFUT_BIND="$BIND"
 export OPENFUT_ADVERTISE="$ADV"
 # POW keys advertised by blaze must also point at the server, not loopback.