Add first-class virtual network resources

[halfcyan]

Summary

Move from string-only net:// references toward explicit virtual network resources and VM attachments.

Scope

• Define network identity, subnet, bridge mode, and ownership.
• Resolve network attachments into TAP/bridge configuration.
• Preserve existing net:// compatibility during migration.
• Add lifecycle operations or internal resource handlers.
• No compatibility layer for unreleased Odorobo network references is required.

Tasks

• Define the virtual network resource and VM attachment data model.
• Add network identity, subnet, bridge mode, and ownership fields.
• Implement resolution of named networks into TAP and bridge configuration.
• Define the new network reference format and update all in-development callers to use it.
• Add lifecycle operations or internal handlers for network resources.
• Define network teardown and ownership checks.
• Add tests for resource creation, attachment, compatibility, and cleanup.
• Document the network resource and attachment contract.

What this should do

• A VM can refer to a named virtual network.
• The agent creates or verifies the required host-side resources.
• Network ownership and teardown are explicit.
• All in-development Odorobo VM and networking code uses the new network resource contract.

Dependencies

• Depends on draft issue 01.

Related issues

• Related to VM Agents: Configuration #16 (VM agent configuration).
• Enables draft issue 08.

Issue links

• Depends on #98.
• Related to existing #16.
• Enables #105.