The pre-cutover DHCP-client uplink into the old LAN was a hand-written systemd.network block in the gw-cnx-1 machine config. Make it a router setting next to trunkPorts/accessPorts so every replacement gateway can stage the same way, with an assertion that the port is not also the WAN, a trunk or an access port. gw-cnx-1 sets stagingPort = "enp3s0" in the inventory; the machine-local block is gone.