Tie a network context to its network's UID on every write #834

A network context names its network by name, and two of its writes still do not check which network that is. ecv raised both in the review of #831. Two networks of one name can overlap: a Network's finalizer waits only for the contexts it lists, and the presence controller expects an earlier network's context to survive.

Proposed scope

• The binding controller stamps the network's UID on the context it creates with internal DNS off (L119–L137). Without the label, the presence controller cannot mark that context. Staging and production both run with internal DNS on, so this path is not in use there.
• The mark carries a precondition (L403–L415), as the presence controller's delete does (L238). A stale read then cannot mark a context of the same name that was created in between.

Non-goals

• A UID check at the location. #828's thread says why: a location holds no Network, and an interface names its network by name only.

Acceptance criteria

• A context created with internal DNS off carries the network's UID, and a deleting network marks it
• A mark built from a stale read of a context since replaced changes nothing, and the presence tries again from a fresh read

Related to #664