Audit retained routing safety at startup and close admission coverage

[chet]

After the three writer PRs land, startup must prove that retained prefixes and routing relationships are safe before listeners or controllers can serve them. This is also the right final point to audit every writer that can expand routing visibility and close any remaining concurrency gap without introducing another monolith.

Scope

• Compose the prefix, route policy, and retained Instance checks after seeding and Admin VPC reconciliation and before listeners/controllers start, including listen_only.
• Add a focused retained state audit using targeted SQL/DAO queries rather than an O(n²) comparison of every address pair.
• Run the retained state audit using the same transaction lock introduced by Enforce overlap admission for prefix-bearing writes #5113.
• Audit every current writer that can expand routing visibility and prove each participates before Install scoped prefix constraints while global exclusions remain #3891 merges.
• When the gate is disabled, reject expansion while preserving reads and safe contraction/drain.
• Extract a shared module later only if the landed caller code has useful duplication.

Acceptance criteria

• Startup rejects retained direct, peer, sibling, policy, or Instance overlap that would be unsafe.
• Legacy Admin startup reconciliation remains compatible.
• Concurrent prefix and policy changes, and concurrent prefix and Instance changes, cannot both pass by reading stale state.
• All current writers that can expand routing visibility are enumerated and covered by handler tests.
• No external work occurs while the transaction lock is held.
• The retained state audit and concurrency tests pass without enabling duplicate persistence.

Out of scope

• Scoped database constraints and the global exclusion cutover (Install scoped prefix constraints while global exclusions remain #3891 and Retire global prefix exclusions for eligible FNN VPCs #3892).
• DPU convergence and withdrawal (Apply dynamic tenant-root isolation and gate SitePrefix readiness on DPU application #3894/Drain VpcPrefix and NetworkSegment withdrawals through existing DPU acknowledgements #3895/Drain VPC peering withdrawals through existing DPU acknowledgements #3896).
• A 3,000-line central evaluator or broad controller lock sweep.

Dependencies

• Blocked by: Enforce overlap admission for prefix-bearing writes #5113, Enforce overlap admission for VPC and peering policy changes #5114, and Include retained instance routing paths in overlap admission #5115.
• Enablement relationship: Completing this issue after those writer issues satisfies Enforce overlap eligibility and route-consumer safety atomically #3890. The force-delete fence landed in fix(instance): mark Instances deleted before force-delete cleanup #5429; Apply dynamic tenant-root isolation and gate SitePrefix readiness on DPU application #3894, Drain VpcPrefix and NetworkSegment withdrawals through existing DPU acknowledgements #3895, and Drain VPC peering withdrawals through existing DPU acknowledgements #3896 continue to own DPU application and withdrawal.
• Parallel work: Install scoped prefix constraints while global exclusions remain #3891 implementation can proceed, but Install scoped prefix constraints while global exclusions remain #3891 remains blocked from merge until Enforce overlap eligibility and route-consumer safety atomically #3890 is complete.

Reference implementation and test corpus: #4940. Part of #3890 and #3883.