feat: materialize L3Out eBGP operational sessions for runtime-pushed tenants (v0.18.0)

A tenant L3Out POSTed live via /api/mo (cisco.aci / aci-py) only landed the
bgpPeerP config MO; the operational bgpPeer/bgpPeerEntry/bgpPeerAfEntry that
build/l3out.py emits for topology-defined L3Outs never existed for it, so
per-tenant L3Out BGP session views stayed empty. writes.py now reacts to
runtime bgpPeerP writes: dom-{tenant}:{vrf} (VRF from l3extRsEctx, ASN from
the nested bgpAsP, node from the path DN), operSt=established. Skips when no
VRF is bound or on status=deleted. 3 new regression tests; suite: 903 passed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,23 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 (pre-1.0: minor bumps may include breaking changes to the sim's behavior).
 
+## [0.18.0] - 2026-07-06
+
+### Added
+- **Runtime tenant-L3Out eBGP session materialization** — a tenant L3Out
+  pushed live via `POST /api/mo` (cisco.aci playbooks / aci-py) lands
+  `bgpPeerP` (config) through the generic write path, which never produced
+  the operational session MOs. `writes.py` now reacts to every runtime
+  `bgpPeerP` by materializing `bgpPeer`/`bgpPeerEntry`(`operSt=established`)/
+  `bgpPeerAfEntry` under a `dom-{tenant}:{vrf}` BGP domain on the L3Out's own
+  node — the peer ASN derived from the nested `bgpAsP`, the VRF from the
+  L3Out's `l3extRsEctx.tnFvCtxName` (skips cleanly when no VRF is bound, or
+  on `status=deleted`). This mirrors what `build/l3out.py` already does for
+  topology-defined L3Outs, and makes per-tenant L3Out BGP session views in
+  API clients (e.g. autoACI's "L3Out BGP" topology table) populate for
+  runtime-pushed tenants. New regression tests in
+  `tests/test_l3out_bgp_session.py` (903 tests total).
+
 ## [0.17.0] - 2026-07-05
 
 ### Added