feat(network): apply richer IPAM at network creation time

[chrisgeo]

Summary

Extends container network create and the container-network-vmnet plugin to honor six compose-spec / Docker-style network creation options that were previously silently dropped: --gateway, --ip-range, --aux-address, --driver-opt, --ipv6, and --attachable.

The vmnet plugin actually wires the user's gateway override and IPv4 sub-range constraints through to the runtime; aux-address reservations are pre-allocated in the per-network attachment allocator so the dynamic pool never hands them out.

This is the upstream-shaped staging PR for CHAOS-1334 (Container-Compose). Companion downstream PR will land after this is reviewed.

CLI surface

container network create mynet \
    --subnet 10.0.0.0/24 \
    --gateway 10.0.0.254 \
    --ip-range 10.0.0.128/28 \
    --aux-address db=10.0.0.10 \
    --aux-address web=10.0.0.20 \
    --driver-opt mtu=1500 \
    --ipv6 \
    --attachable

Flag	Where it takes effect	Notes
--gateway <IPv4>	vmnet_network_configuration_set_ipv4_subnet's gateway parameter (Reserved + AllocationOnly variants)	Replaces hard-coded subnet.lower + 1. Requires --subnet.
--ip-range <CIDRv4>	AttachmentAllocator lower/size bounds	Restricts dynamic IPv4 pool to a sub-CIDR of --subnet.
--aux-address HOSTNAME=IP	RotatingAddressAllocator.reserve(_:) pre-reservation	Repeatable. In-range entries are reserved; out-of-range entries are recorded but require no allocator state.
--driver-opt KEY=VALUE	Persisted on NetworkConfiguration and forwarded to plugin argv	Repeatable. vmnet plugin does not interpret any keys today; surface exists for future enhancements without another wire break.
--ipv6 (bare)	Reserved variant only — vmnet auto-allocates IPv6 prefix	AllocationOnly variant rejects with actionable error pointing at reserved variant on macOS 26+.
--attachable	No-op on apple/container (no swarm concept)	Accepted for compose-spec parity. CLI emits explicit advisory on stderr.

What changed

• Sources/ContainerResource/Network/NetworkConfiguration.swift — six new optional fields with decodeIfPresent / encodeIfPresent Codable plumbing and end-to-end validation.
• Sources/ContainerCommands/Network/NetworkCreate.swift — matching CLI flags.
• Sources/Services/ContainerAPIService/Server/Networks/NetworksService.swift — registerService serializes the new fields into plugin start argv (JSON for the aux-address dict; repeated --driver-opt for opts).
• Sources/Plugins/NetworkVmnet/NetworkVmnetHelper+Start.swift — parses the new argv and reconstructs the richer NetworkConfiguration.
• Sources/Services/ContainerNetworkService/Server/{Reserved,AllocationOnly}VmnetNetwork.swift — honor user-provided gateway; AllocationOnly explicitly rejects IPv6 requests.
• Sources/Services/ContainerNetworkService/Server/NetworkService.swift — allocator range respects ipv4Range; pre-reserves custom gateway + in-range auxAddresses.
• Sources/Services/ContainerNetworkService/Server/AttachmentAllocator.swift — new reserveHostname(hostname:address:) helper around the underlying allocator's reserve(_:).

Wire compatibility

All new NetworkConfiguration fields are optional and decoded with decodeIfPresent. Configurations persisted by older daemons decode cleanly with nil defaults (covered by testLegacyConfigurationDecodesWithoutNewFields). Plugin argv is purely additive — newer server vs. older plugin and vice versa both behave correctly.

Known limitations (intentional, follow-up work)

• --attachable is parsed but produces no behavioural change on apple/container today. The CLI surfaces this explicitly on stderr.
• --driver-opt is forwarded but the vmnet plugin interprets no specific keys yet.
• Bare --ipv6 is honored on the reserved variant only; AllocationOnly emits an actionable error pointing at the reserved variant on macOS 26+.
• The IPv4 gateway override only takes effect when an explicit --subnet is also supplied (vmnet is source of truth otherwise).

Verification

• swift build -c release — clean on macOS 26 / Apple silicon.
• swift test --filter ContainerResourceTests.NetworkConfigurationTest — 11/11 passing (3 pre-existing + 8 new). Coverage: gateway/range/aux-address positive + negative validation, full-shape Codable round-trip, legacy-config decode regression.

[linear]

CHAOS-1334 Compose networks: apply driver_opts / attachable / enable_ipv6 / internal / ipam at runtime