Add targeted node filtering to deploy reconciliation

[orrious]

Summary

Add targeted node filtering to reconciliation of an already-deployed lab.

• allow clab deploy --node-filter and the clab apply alias to add or recreate only selected nodes
• compute dependency closure for wait-for and network-mode: container:<provider>
• preserve nodes, endpoints, and links outside the selected closure
• include links required by selected added or recreated nodes, even when the peer is an existing unselected node
• normalize endpoint ownership for shared network namespaces so only the provider owns discovered interfaces
• checkpoint filtered state without persisting runtime-injected environment drift
• preserve filtered-added nodes for later destroy
• add unit and smoke coverage

Validation

• focused core and command tests pass on Linux amd64
• the same focused tests pass natively on Linux arm64
• rootful Podman lifecycle on x86:
  • filtered dry-run selected only the provider dependency closure
  • required cross-scope link was created
  • unrelated existing container IDs remained unchanged
  • the provider and two shared-netns children saw the same interface
  • a second dry-run was empty
  • destroy removed all smoke nodes
• macOS/Colima Docker lifecycle passed the same assertions
• GoReleaser snapshot RPMs built for x86_64 and aarch64 and were installed on both lab runners

This branch is a single commit rebased directly on current upstream main.

[orrious]

Rebased this branch onto current main, resolved the rebase conflicts, and force-pushed the updated head.

Current head: 7606ce097

During runner validation, the rebase exposed a failing unit test in TestDiscoverLiveApplyEndpointsRejectsStoppedExternalNode. I fixed that test-only regression on top of the rebased branch and reran validation.

Final validation completed on the real lab runners:

• x86 runner: go test ./core ./types ./nodes passed
• ARM runner: go test ./core ./types ./nodes passed