Allow execution-time IPs for unresolved adoption NICs

[d4m14ndx]

Summary

• preserve an immutable adoption manifest even when a discovered NIC IP is missing
• accept exact netN=IPv4 inputs in the guarded one-shot runner only for the unresolved NIC set
• reject duplicate/noncanonical IPs, existing CloudStack IPs, and CloudStack-managed IPs outside the mapped guest range
• freeze operator IPs into the durable execution-plan hash before deploy; discovered IP, MAC, NIC order, and network UUID remain immutable
• retain bounded CloudStack inventory access, including network-scoped IP-range reads

Operator usage

bash adopt-one.sh CLUSTER:VMID MANIFEST_SHA256 net0=192.0.2.10

Repeat netN=IPv4 exactly once for each unresolved NIC. No IP arguments are accepted for NICs whose IP was discovered.

Safety

• normal executor and reconciliation flags remain disabled
• no automatic or bulk adoption is added
• no Proxmox lifecycle or configuration mutation is added
• live CloudStack collision/range checks run immediately before the immutable execution plan is created
• existing execution plans remain compatible

Validation

• 211 passed, 4 skipped, 302 subtests passed
• Ruff (F,I) passed
• ShellCheck passed
• Bash syntax passed
• Python compileall passed
• git diff --check passed
• Gitleaks committed range scan passed