Harden CNI provider and host-port convergence

[chen21019]

Result

• preserve the exact eligible CNI provider selected by the watcher instead of relisting by service label at invocation
• select the highest numeric OCI image version deterministically; nonnumeric labels cannot displace a numeric release
• install and repair generated wrappers with exclusive random temporary files, atomic rename, regular-file/type and 0700 checks
• resolve transient missing host-port metadata IPs from the selected running container netns, constrained to exactly one address in the managed subnet and revalidated against the same PID
• preserve the last known-good host-port rules when convergence is ambiguous or unsafe
• document the module boundary and v0.8.21 behavior

Verification

• git diff --check
• offline Go 1.27 unit tests (-mod=vendor -cover -tags=test ./...) and go vet ./...
• two-host Ubuntu 26.04 / Docker 29 runtime QA
  • Docker native nftables
  • Docker iptables backend with iptables-nft frontend
  • Docker iptables backend with iptables-legacy frontend
  • IPsec, VXLAN, per-host subnet, and layer-2 flat: cross-host container traffic, host ports, DNS, Metadata, platform egress
  • Docker restart and backend restoration
  • wrapper content, mode, and symlink drift repair with exact SHA-256 restoration
• Codex Security final diff scan: 4/4 surfaces closed, 0 findings

The required PR workflow remains authoritative for race testing, govulncheck, Trivy, reproducible build, SBOM, and image scan.