Golden captures of SaaS filter-rules and netmaps across the ACL, grant, routes, and SSH corpora. These back the data-driven compat tests that verify headscale's policy output against Tailscale SaaS verbatim. Updates #3157