Bind unresolved adoption IPs through External callbacks

[d4m14ndx]

Summary

• accept exact operator IPv4 only for immutable NICs explicitly marked unresolved
• freeze canonical device/IP overrides into the execution plan and callback proof
• resume exact same-plan executions before live collision checks
• recover existing proof-less legacy external-IP manifests such as VM101 without guest-agent discovery
• preserve exact MAC/bridge/VLAN, CloudStack plan, authority, and zero-source-mutation gates

Exact-head verification

• backend unittest: 218 passed, 4 expected MariaDB skips
• Linux extension harness: 36 passed
• Python 3.12 production image: 211 passed, 4 expected skips
• MariaDB 11 integration: 4 passed
• Ruff fatal checks, compileall, Bash syntax, ShellCheck, diff check: passed
• Gitleaks: no leaks found

VM101 recovery reuses its existing deterministic CloudStack VM; no new claim, deploy, or destroy is permitted.