Strengthen Phase 7 AND provisioning, lease DB guarantees, and reconciliation

[aidankhogg]

Motivation

• Ensure AND subnet allocation uses registry-seeded address pools with DB-backed uniqueness and collision handling instead of a deterministic ord-sum fallback.
• Persist explicit AND runtime-state so update/teardown/reconciliation decisions are based on recorded profile features.
• Add reconciliation and repair paths to compare desired AND instances with actual Docker networks, gateway attachments, DNS/DHCP/reverse-DNS, and BGP sidecars to recover from partial failures.

Description

• Replace the old ord-sum CIDR selection by delegating allocation to DomainRegistryHandler.allocate_address and add a mock-only fallback in _allocate_address in netengine/phases/phase_ands.py when pools are not seeded.
• Implement robust allocation in netengine/handlers/domain_registry_handler.py that reuses existing leases for and_name, enumerates /24 candidates inside a profile pool, skips already‑leased CIDRs, retries on collisions, uses upsert to persist leases and raises RegistryError on exhaustion.
• Add a DB-level uniqueness guard by updating migrations/001_initial.sql to include CONSTRAINT address_leases_cidr_unique UNIQUE (cidr).
• Introduce an explicit ANDInstanceState typed schema and ands_instances field in netengine/core/state.py, and persist profile feature flags (dynamic_ip, reverse_dns, bgp) with each stored AND instance in netengine/phases/phase_ands.py.
• Add reconciliation/update/teardown/repair implementations to netengine/phases/phase_ands.py (reconcile, _update_and_profile, _teardown_and, _repair_and) that handle creating/removing Docker networks, gateway rule application, DNS zone records, DHCP config, reverse DNS zones, BGP sidecars, and cleaning DB leases/and_instances rows.
• Add unit/integration tests in tests/test_phase_ands_strengthening.py to cover address-pool exhaustion, CIDR collision skipping, dynamic IP/DHCP setup, reverse DNS setup, optional vs required BGP behavior, and reconciliation after partial failure.

Testing

• Ran pytest tests/test_and_profiles.py tests/integration/test_m7_ands.py tests/test_phase_ands_strengthening.py -q and the targeted AND/registry tests passed.
• Ran focused pytest tests/test_registry_handlers.py tests/test_phase_ands_strengthening.py -q to validate lease upsert and allocation/collision behavior and they passed.
• Ran the full test suite via pytest -q and observed 580 passed, 10 skipped indicating no regressions in existing tests.

---

Codex Task