R1 is outside the fabric, with the network 10.100.100.0/24 behind it. An L3Out is how a VRF reaches the outside: a routed port on a border leaf, a next hop, and the external subnets. To policy, the outside is one more group of endpoints, so a contract is needed there too.