Define overlap eligibility configuration and profile policy

[chet]

Tenant prefix reuse must remain opt-in at both the site and routing-profile boundaries. Those configuration contracts can be reviewed independently from database serialization and admission call sites.

Scope

• Add the default-false site setting tenant_prefix_overlap_enabled.
• Add the default-false FNN base-profile setting tenant_prefix_overlap_eligible.
• Add one pure, fail-closed eligibility predicate for a resolved VPC routing profile.
• Require an eligible profile to be explicitly opted in, internal, and free of imports, exports, underlay/default/host leaks, tenant leak communities, and anycast routes.
• Document the defaults and that these settings have no effect until the admission work under Enforce overlap eligibility and route-consumer safety atomically #3890 lands; configuration alone does not permit duplicate prefix persistence.
• Keep the profile opt-in in the base profile; do not make it a per-VPC override.

Acceptance criteria

• Missing settings preserve current behavior and resolve to false.
• Table-driven tests cover imports, exports, underlay/default/host leaks, tenant leak communities, public/internal profiles, anycast routes, and fields that do not alter routing.
• Eligibility is evaluated after VPC routing-profile overrides are resolved.
• A VPC cannot override the base profile's overlap opt-in.
• An unused unsafe profile does not by itself reject an otherwise unrelated site.
• No handler, database lock, startup gate, or uniqueness constraint changes in this issue.

Out of scope

• Prefix or peering admission.
• Removing database exclusions.
• Per-profile/per-VPC isolation rendering.
• A new routing-profile framework.

Dependencies

• Blocked by: None.
• Enables: Prefix, route-policy, retained-instance, and startup admission under Enforce overlap eligibility and route-consumer safety atomically #3890.
• Parallel work: Renderer direction, the transaction lock, and force-delete fencing.

Reference implementation and test corpus: #4940. Part of #3890 and #3883.