Enforce overlap admission for prefix-bearing writes

[chet]

VpcPrefix creation/adoption and NetworkSegment creation/attachment are the smallest routing-expanding address writers. They should own their candidate construction close to the call site and reuse existing targeted database probes instead of loading a site-wide in-memory graph.

Scope

• Apply the Enforce overlap eligibility and route-consumer safety atomically #3890 eligibility contract to VpcPrefix create/adoption and NetworkSegment create/attach.
• Acquire the routing-admission lock before resource locks, then re-read and validate inside the same transaction as the write.
• Reuse and extend db::vpc_prefix::probe, probe_segment_prefixes, and existing NetworkPrefix queries.
• Keep candidate adapters beside their handlers until repeated structure is demonstrated.
• Keep deleting/retained rows conflict-visible.
• Return tenant-safe errors without disclosing another tenant's CIDR or resource details.

Acceptance criteria

• Same-VPC overlap, direct-prefix conflicts, nested overlap, wrong tenant, invalid SitePrefix, unsafe profile, and invalid VNI cases fail.
• Eligible exact reuse across isolated tenants passes application admission while the legacy database exclusion still blocks persistence.
• VpcPrefix-vs-VpcPrefix and VpcPrefix-vs-NetworkSegment concurrency tests cover both winner orderings and prove the second writer re-reads after the lock.
• Candidate work is scoped to relevant conflicts; it does not compare every address pair at the site.
• Unattached creates, ordinary deletes, and unrelated updates do not take this lock.

Out of scope

• Peering, VPC/NSG policy, and retained-instance admission.
• Scoped database constraints and the global-exclusion cutover (Install scoped prefix constraints while global exclusions remain #3891 and Retire global prefix exclusions for eligible FNN VPCs #3892).
• A central full-site routing-state object.

Dependencies

• Blocked by: The overlap configuration and routing-admission lock siblings; Associate VpcPrefixes with exact SitePrefix parents and parent-scoped allocation #3886 is complete.
• Parallel work: Route-policy and retained-instance admission.
• Initiative relationship: Together with the other admission siblings and startup closure, completes Enforce overlap eligibility and route-consumer safety atomically #3890. Install scoped prefix constraints while global exclusions remain #3891, Drain VpcPrefix and NetworkSegment withdrawals through existing DPU acknowledgements #3895, and Drain VPC peering withdrawals through existing DPU acknowledgements #3896 remain blocked on Enforce overlap eligibility and route-consumer safety atomically #3890.

Reference implementation and test corpus: #4940. Part of #3890 and #3883.