fix(route-steering): incrementally advance owned reconciliation

[VerifiedOrganic]

Safety argument

This replaces the unsafe terminal whole-collection classifier/diff with a fresh incremental state machine. Each public advance performs exactly one unit: one dump cursor start/poll/datagram, one object canonicalization/insertion, one canonical materialization, one ordered merge comparison, or one mutation plus its authoritative verification. Dump bodies are handed off per datagram into ownership-moving batch queues; no cursor accumulates a complete dump.

A terminal netlink datagram that contains both data and NLMSG_DONE now yields its data batch first and latches completion for the next bounded cursor unit. It cannot cause false absence, an unsafe delete, or dropped resident state. Completion is O(1): exhaustion of the ordered install/remove merge cursors is the exact equality proof, so the terminal state does not call whole-vector equality. The desired digest is computed during desired-set construction, not by cloning/scanning in plan creation; the opaque plan binds backend identity, scope, desired digest, streamed baseline fingerprint, and mutation generation.

Plan steps run inline under the clone-shared operation lock and release it before returning. No step uses detached blocking work; drop/cancellation leaves no background poll or mutation. Every mutation advances the generation and is followed by fresh authoritative readback. Exact or legacy interference returns terminal Superseded; an uncertain mutation returns terminal Indeterminate and is never replayed. Install-before-delete, collision fail-closed behavior, and #722 disjoint source-rule siblings remain preserved.

Evidence

• cargo test -p opc-route-steering --all-targets -- --test-threads=1 (113 passed; 6 CAP_NET_ADMIN live tests ignored)
• cargo clippy -p opc-route-steering --all-targets -- -D warnings
• git diff --check and git diff origin/main...HEAD --check

Deterministic coverage includes a 50k test requiring at least 200k individual public steps with at most one cursor poll per step; terminal data+DONE preservation and no-mutation exact-resident plan coverage; preemption, supersession/no stale delete, no detached drop, no-replay/indeterminate, foreign collision, and #722 sibling tests.

[VerifiedOrganic]

Deferring the current stepped-reconciliation proposal aea73af8da62a193343614ddafb08bdb0632b68f after source review. It supersedes the older prototype #721, which is now closed, but it still has a concrete bounded-step issue: reconcile_owned_route_rules_step assigns plan.collector = None while holding operation_lock; IncrementalOwnedCollector::advance_one moves the final snapshot members but leaves the collection-sized route_ranges tree in the collector. Dropping that tree performs whole-collection destruction inside one advertised bounded unit. This is a static finding, not measured latency qualification. The new production expect calls also conflict with CONTRIBUTING's non-test panic policy.

Next step for the PR maintainer: make terminal collector cleanup respect the bounded work/lock contract, remove the production expect calls, and add a regression that accounts for cleanup work at the maximum collection size with an urgent waiter. Obtain independent review of mutation authority, generation fencing, cancellation and terminal outcomes on the corrected head, then rerun all current gates. The existing CI run has failures in misc, it-0, heavy-0 and heavy-1; those failures remain failures. Keeping this open as a draft; closing #721 does not certify this successor.