You set 'priority level 1' for NC+AF, 'priority level 2' for BE, and leave LE unset on the ingress policy.
This sets the fabric priority, and VoQ will honor it.
I am very glad this is possible on the 9k. Are you certain there are no negative consequences moving the entire BE traffic into a fabric priority queue (back-pressure, etc)?
Mind you, in your scenario, even without ASR9k priorities, the network is protected. [...] Even if ASR9k congests the victim (which it shouldn't with the right priority level), the rest of the core is protected, so the blast zone is still just the victim.
The *transit* network is technically protected. But the incentive for the *customer* network to actually announce the scavenger route is gone. If the transit network is injecting a scavenger route itself without involving the customer, sure, then this makes sense for the benefit of the transit network. But more likely the transit customer already switched to RTBH instead anyway. I'm happy to hear this is possible on the 9k. Lukas