net: scope host device families per installation (net_scope)

[CMGS]

Problem

GC sweeps two host-wide name families by name — bridge TAPs bt<vmid8>-<nic> in the host netns and CNI netns cocoon-<vmid> under /var/run/netns — and reclaims every entry whose VM its own DB does not know. Both prefixes were package constants, so any second installation on the same host (another root_dir, or a cocoon-derived runner such as cocoon-macos that provisions through cocoon's bridge/CNI backends) lands in the same families and has its live guests' TAPs / netns torn down by the peer's sweep (observed: btALZMITW2-0 reclaimed by the hourly GC, guest SSH No route to host).

Fix

One installation-identity knob; cocoon stays ignorant of any particular downstream — each installation only manages its own families.

• config.Config.NetScope (net_scope, env COCOON_NET_SCOPE): two alphanumerics; empty keeps the legacy bt / cocoon- names. Scoped families are <scope><vmid8>-<nic> and <scope>-<vmid>. The fixed length means no two scopes are prefixes of each other, so families are disjoint by construction; bt and rm are rejected because they alias the legacy bridge family and CH's transient restore TAPs.
• Naming primitives live in network next to TAPName: BridgeTAPPrefix(scope), NetnsPrefix(scope), ValidateScope, RestoreTAPPrefix (moved from cloudhypervisor).
• bridge: New resolves the prefix once; GCModule(prefix) / CleanupTAPs(prefix, ids) take the resolved string like the sibling CgroupGCModule / vmlock.GCModule registrations; parseTAPName matches the configured prefix only.
• cni: netnsName / netnsPath are Config methods; the GC netns scan cuts the scoped prefix.
• cmd/core passes the resolved prefix; viper registers net_scope; docs (cli.md, networking.md, gc.md) describe the families and the knob.

Defaults are unchanged, so existing installations keep their device names. A second installation sets net_scope before its first VM.

Evidence

• make lint GOOS=linux + darwin: 0 issues; asl ./... both GOOS: clean (the pre-existing meta/sqlite/store.go finding is fixed in the separate review: commit)
• go test ./... darwin: green
• Linux (docker golang:1.26.5): go test ./config/ ./network/... ./cmd/core/ ./hypervisor/cloudhypervisor/ green; linux-only TestParseTAPName runs and passes with a foreign-scope negative case
• /simplify four lenses applied (single knob, primitives moved to network, resolved-string signatures, no cached-vs-derived duplication)

Follow-up (cocoon-macos)

Set NetScope in its config.Config literal (e.g. mt) and pass network.BridgeTAPPrefix(conf.NetScope) to bridge.CleanupTAPs.