Include retained instance routing paths in overlap admission

[chet]

Instances can make several VPCs simultaneously route-visible through current or pending configuration. Admission must treat that retained union as a receiver without folding unrelated controller cleanup and force-delete behavior into the same PR.

Scope

• Apply the overlap profile and routing-admission lock to instance allocation and configuration changes that expand routing visibility.
• Build the candidate from network_config plus both old_config and new_config in any update_network_config_request.
• Include attached VPCs, directionally imported peers, routing overrides, and attached NSG policy needed for the decision.
• Keep the logic close to the instance allocation/configuration paths.
• Do not lock metadata-only updates or controller steps that can only remove routing visibility.

Acceptance criteria

• Direct and peer-visible multi-homed overlap fails.
• Unresolved retained references, unsafe routing overrides, and unsafe attached NSGs fail closed only when prefix reuse makes them relevant.
• Ordinary unique-address and no-overlap instance behavior remains compatible.
• Both concurrency winner orderings prove the second writer re-reads after the lock.
• Metadata-only updates remain concurrent.

Out of scope

• Admin force-delete fencing, tracked separately.
• Instance hard-delete controllers and DPU withdrawal acknowledgement.
• Prefix/peering handler adoption.
• A general instance lifecycle rewrite.

Dependencies

• Blocked by: Overlap configuration and the routing-admission lock siblings.
• Parallel work: Prefix and route-policy admission.
• Initiative relationship: Together with the other admission siblings and startup closure, completes Enforce overlap eligibility and route-consumer safety atomically #3890. The force-delete fence remains a separate tenant-prefix-reuse prerequisite; Install scoped prefix constraints while global exclusions remain #3891, Drain VpcPrefix and NetworkSegment withdrawals through existing DPU acknowledgements #3895, and Drain VPC peering withdrawals through existing DPU acknowledgements #3896 remain blocked on Enforce overlap eligibility and route-consumer safety atomically #3890.

Reference implementation and test corpus: #4940. Part of #3890 and #3883.