Audit retained routing safety at startup and close admission coverage

[chet]

After the three writer-adoption PRs land, startup must prove that the retained routing graph is safe before listeners or controllers can serve it. This is also the right final point to audit every expansion writer and close any cross-writer concurrency gap without introducing another monolith.

Scope

• Compose the prefix, route-policy, and retained-instance admission contracts after seeding and Admin-VPC reconciliation and before listeners/controllers start, including listen_only.
• Add a focused retained-state audit using targeted SQL/DAO queries rather than an O(n²) all-address pair scan.
• Run the retained-state audit under the same routing-admission lock used by writers.
• Audit every current routing-expanding writer and prove each participates before Install scoped prefix constraints while global exclusions remain #3891 merges.
• Keep gate-off behavior fail-closed for expansion while preserving reads and safe contraction/drain.
• Leave shared-module extraction for a follow-up only if the landed call-site code has obvious duplication.

Acceptance criteria

• Startup rejects retained direct, peer, sibling, policy, or instance overlap that would be unsafe.
• Legacy Admin startup reconciliation remains compatible.
• Prefix-vs-policy and prefix-vs-instance concurrent expansion cannot both pass stale state.
• All current expansion writers are enumerated and covered by handler-level tests.
• No external work occurs while the transaction lock is held.
• The retained-state audit and cross-writer concurrency tests pass without enabling duplicate persistence.

Out of scope

• Scoped database constraints and the global-exclusion cutover (Install scoped prefix constraints while global exclusions remain #3891 and Retire global prefix exclusions for eligible FNN VPCs #3892).
• DPU convergence and withdrawal (Apply dynamic tenant-root isolation and gate SitePrefix readiness on DPU application #3894/Drain VpcPrefix and NetworkSegment withdrawals through existing DPU acknowledgements #3895/Drain VPC peering withdrawals through existing DPU acknowledgements #3896).
• A 3,000-line central evaluator or broad controller lock sweep.

Dependencies

• Blocked by: Prefix-bearing, route-policy, and retained-instance admission siblings.
• Enablement relationship: Completing this issue after the three writer-adoption siblings satisfies Enforce overlap eligibility and route-consumer safety atomically #3890. Force-delete fencing remains a separate tenant-prefix-reuse prerequisite; Apply dynamic tenant-root isolation and gate SitePrefix readiness on DPU application #3894/Drain VpcPrefix and NetworkSegment withdrawals through existing DPU acknowledgements #3895/Drain VPC peering withdrawals through existing DPU acknowledgements #3896 continue to own DPU application and withdrawal.
• Parallel work: Install scoped prefix constraints while global exclusions remain #3891 implementation can proceed, but Install scoped prefix constraints while global exclusions remain #3891 remains blocked from merge until Enforce overlap eligibility and route-consumer safety atomically #3890 is complete.

Reference implementation and test corpus: #4940. Part of #3890 and #3883.