The freedom-wgnet policy table (1002) had IPv4 throw routes for the Tsinghua/
CERNET ranges (101.6/16, 166.111/16, ...) so LAN clients reach them direct via
the campus uplink (wan99.0), but had NO IPv6 equivalent -> every v6 destination,
including CERNET, was default-routed through the wg tunnel to skyw-gw. Since
mirrors.tuna.tsinghua.edu.cn is AAAA-preferred, LAN clients hit the tunnel path
for v6 and timed out (TCP handshake started, cert/data flight black-holed),
while v4 worked -- looking like a "TLS downgrade" but actually a routing detour.

Add v6 throw routes for the CERNET blocks (2402:f000::/32 Tsinghua/tuna,
2001:da8::/32 CERNET2, 2001:250::/35 CERNET), mirroring the v4 throws and
skyw-gw's cn_net_v6 direct set. Verified live on xlab-gw: LAN v6 client -> tuna
now egresses wan99.0 direct (http 200), was timeout.

Co-Authored-By: Claude Opus 4.8 <[email protected]>