Prevent test network lock convoys

[yummybomb]

Summary

This pr was made using the flake testing skill in hypeman, from this action, which failed in main: https://github.com/kernel/hypeman/actions/runs/33411612595/attempts/1

• keep the shared subnet lock limited to route selection and lease-file updates
• run stale network cleanup behind a separate non-blocking lock
• delete iptables entries by exact rule specification and reuse the orphan sweep's rule listing

Why

Concurrent Linux test suites could hold the shared subnet lock while performing slow bridge and iptables cleanup. Other integration tests then blocked on lease allocation or release until the package-level timeout fired.

Tests

• go test -count=20 -run '^(TestTryWithTestFileLock|TestReleaseRemovesLeaseBeforeNetworkArtifacts|TestParseIPTablesAppendRule)$' ./lib/instances
• three consecutive no-cache full-suite runs with CI-equivalent Linux settings: 285s, 443s, 369s

---

Note

Medium Risk
Changes shared-host test networking locks and iptables teardown used by parallel integration tests; incorrect ordering or parsing could cause lease races or stray rules, though scoped to the test harness.

Overview
Addresses parallel Linux integration tests timing out when many suites block on the same subnet lease lock while one holder runs slow bridge/iptables cleanup.

The blocking subnet lock now covers only lease-file reads/writes and subnet selection. Stale route and orphan iptables sweeps run under a separate non-blocking file lock (tryWithTestFileLock), so allocators skip cleanup if another process is already sweeping. Test teardown is centralized in releaseTestNetworkLease: drop the lease under the subnet lock, then run host artifact cleanup outside that lock.

iptables cleanup no longer uses mutable line numbers; it parses iptables -S append lines via parseIPTablesAppendRule and deletes by exact rule spec, including all duplicate orphan rules. Test harness comment matching is anchored to full hm* comments.

Adds unit tests for the non-blocking lock, release ordering (lease gone before route delete), and rule parsing; NOTES.md documents the CI flake and validation.

^{Reviewed by Cursor Bugbot for commit 44e1f8a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 334ad51. Configure here.}

[sjmiller609]

looks good. thanks!