docs(networking): record OVN ownership and address consumption

[jmgilman]

Change

• Record two external addresses per tested OVN sandbox: NAT router plus one forward. The current 16-address allocation supports eight by address capacity, with no keeper reservation remaining.
• Require exclusive fast40-uplink ownership of fast40 on every member; remove obsolete raw-macvlan guidance. Managed-only sandbox NICs and a fleet default-project preflight enforce the boundary.
• Require central for OVN control-plane operations; Errored networks can be deleted by the reaper after central recovery.

The post-fixture-removal lab01 gateway cycle passed all checks in 31.018 s: PROCEED. This resolves parent contention, not the independent central-outage creation issue.

Verification

moon run docs:build passed. No networking config or design draft changes.

Companions: https://github.com/GilmanLab/fleet/pull/16 and GilmanLab/agentcompute#16 . Requested ARCHITECTURE_GO.md and Phase 5 prompt updates were scoped to journal/jmgilman.