The big problem with your requirements is the requirement that same interface running two VLANs (untagged and 999) uses two distinct MAC addresses. It is not possible in ROS ... or at least not directly, vlan interfaces don't have own MAC addresses. But then I don't see necessity for two distinct MAC addresses, the only time LAN devices see RB's MAC address is when they communicate with RB (either directly or when they use it as gateway) ... and since you want to bridge both VLANs, RB would need single IP address (and thus single MAC address) for both VLANs.

BTW, when thinking about your description of purpose of having two VLANs bridged ... I don't think you actually need that. As you're using linux you can create an alias interface and bind second IP address from the same subnet (or another subnet if that makes configuration of RB easier) by configuring "interface" <real_interface>:<alias_name> (e.g. if your real interface is eth0, use eth0:qbt ...). The only remaining problem (not specific to this case at all, it's present whenever machine has multiple IP addresses) is how to ensure that random outgoing connections use "default" IP address. Supposedly the first interface (IP address) from the list of similarly ranked interfaces is used (I guess ranking is done according to routing cost, e.g. if IP addresses are from different subnets, the directly attached wins over gateway).
For specific services it shouldn't be a problem as you can bind a daemon to specific interface.