feat: APIC-style write validation, query-target=children, contract shadow mirroring (v0.21.0)

Three fidelity gaps surfaced by one broken TN2 var file (missing firewall
block), all fixed:
- writes: reject malformed fvSubnet/l3extSubnet/vnsRedirectDest ip values
  with an APIC-style 400 before any store mutation (deletes exempt)
- query engine: support query-target=children (direct children, flat
  imdata, root excluded) — was silently returning empty
- deploy mirror: materialize vzFilter/vzEntry, vzBrCP/vzSubj (+ filter and
  service-graph subject bindings) and vnsAbsGraph shadows per target site;
  undeploy removes them

E2E-verified through the real pipeline (aci-py hidden push): a TN2 var
missing the fw block now fails with 'Invalid value "." for property ip of
vnsRedirectDest ... -> 400' and nothing lands; a complete var set builds
both MS tenants with contract shadows + sgt-FW graph binding on both sites.
Suite: 914 passed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,28 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
 (pre-1.0: minor bumps may include breaking changes to the sim's behavior).
 
+## [0.21.0] - 2026-07-07
+
+### Added
+- **Write validation — fail like real gear**: `POST /api/mo` now rejects
+  malformed property values with an APIC-style 400 instead of absorbing
+  them into the MIT: `fvSubnet`/`l3extSubnet` `ip` must be a valid
+  address[/prefix], `vnsRedirectDest` `ip` a valid IP. (Surfaced by a TN2
+  push whose var file was missing the firewall block: the unguarded J2
+  template rendered `ip=".1/24"` and `ip="."` and the sim accepted both.)
+  Deletes are exempt — cleanup only needs the DN.
+- **`query-target=children`** on MO/class queries (real-APIC semantics:
+  the DIRECT children of each matched root as flat imdata, root excluded,
+  `target-subtree-class` honored). Previously unsupported and silently
+  answered with empty imdata — a verification false-negative.
+- **Deploy mirror: contract/filter/service-graph shadows** — an NDO deploy
+  now also materializes `vzFilter`/`vzEntry`, `vzBrCP`/`vzSubj` (+
+  `vzRsSubjFiltAtt`, and `vzRsSubjGraphAtt` when the NDO contract carries a
+  serviceGraphRelationship) and `vnsAbsGraph` on every target site's APIC.
+  Previously the mirrored EPGs' `fvRsProv`/`fvRsCons` were dangling
+  references (`GET /api/class/vzBrCP` returned 0 fabric-wide) — same family
+  as the F1 fvTenant-root gap. Undeploy tears the shadows down.
+
 ## [0.20.5] - 2026-07-07
 
 ### Docs