feat(incus): complete sandbox networking and lifecycle

[jmgilman]

Changes

• Add project-owned OVN networks, peering, ACLs, forwards, NIC detach, and Linux netem impairment while retaining member-local bridge fallback.
• Add start/stop/restart, readiness waits, file operations, snapshots, sandbox-scoped image publishing, and least-loaded placement with explicit-host precedence.
• Keep management/OOB baseline denies immutable. nat=false creates native isolated network=none segments, consumes no external address, and rejects external forwards.
• Restore restricted snapshots by staging a copy before replacing the original instance. Keep the agent-facing name/ownership; permit UUID/MAC/DHCP identity changes and consume the original snapshots without enabling low-level access.
• Preserve dependency-ordered retryable reaping, reject conflicting network reuse, and retry only confirmed cross-sandbox forward allocation collisions.

Verification

• Final moon root:check passed all 13 tasks, including race-enabled Go tests, lint, builds, documentation, proxy checks, and offline artifact startup.
• Final full OVN acceptance passed in 153.09s; the live isolation-conflict regression passed in 3.55s.
• Final bridge fallback MCP lifecycle passed in 79.13s.
• Live preflight fixtures were refused by name without mutation, then cleaned through fleet.
• Approved central outage and one lab03 reboot preserved surviving traffic, recovered management and the rebooted guest without repairs, and allowed a later reaper to remove the Errored allocation and all owned residue in 3.03s.
• Live automatic placement selected lab03, matching the highest free-RAM eligible member.
• Regression tests were observed failing before and passing after the isolation-reuse and forward-allocation fixes.

Companion changes

• GilmanLab/fleet#19: durable central, client/chassis TLS, preflight, uplink, seeds, and certificate lifecycle.
• GilmanLab/secrets#38: encrypted application-scoped OVN identities.
• docs(ovn): record durable fabric and lifecycle qualification root#33: proposed ADR-0006, address accounting, snapshot semantics, and operational evidence.

All disposable qualification resources and scripts have been removed. No further upstream issues were filed. Public-only OpenTofu certificate metadata reconciliation remains blocked on owner AWS SSO login; active replacement trust is already verified.