feat(netconfig): extract standalone interface bootstrap

[borislitv]

Summary

• Extract interface bootstrap from feat(operator): add netlink dataplane sidecar yanet2#2628 into an independent Go module without YANET2, gateway, neighbour API or DPDK dependencies.
• Provide strict native and compatible Netplan input, delayed KNI handling, partial-progress retries, MTU ordering, IPv6 policy and restart-safe reconciliation without shutdown teardown.
• Provide an idle-after-success CLI with explicit -once and -check modes, scratch runtime images for Linux amd64/arm64, CI and GHCR publication workflows.
• Use Go 1.27.1 in go.mod and Docker builds, testify 1.12.1, x/sys 0.48.0, multierr 1.11.0 and the maintained go.yaml.in/yaml/v3 3.0.5. Other selected libraries are already at their latest stable versions.

Execution contract and simplification

Current HEAD: 5767486b44a0b11aff981134e1c3aa938ff18a8c.

• Netconfig is the only interface configurator in its namespace. The dataplane may create late KNI but must not concurrently rename, delete, recreate or reconfigure observed links. Each creation/configuration phase uses one kernel link snapshot; configuration updates it with its own MTU changes.
• Input validation belongs to configuration loading. Internal helpers consume one worker-owned startup state without repeated validation or defensive deep copies.
• Remove per-operation identity lookups, sysctl descriptor-pinning infrastructure, impossible kernel-object guards and their synthetic tests. Preserve restart compatibility checks, kernel errors, partial progress, MTU constraints, carrier/DAD readiness and unowned addresses.
• Explicit static addresses become permanent and preferred. Enabled automatic IPv6LL requires a usable LL on non-loopback links. Multicast and ::1 on non-loopback interfaces are rejected before kernel access.
• Normalize native and Netplan input directly into desired state in internal/config, sharing the field parser while keeping strict native restrictions and Netplan compatibility explicit. Remove the intermediate native configuration model and conversion pass.
• Replace the stateful fake Linux backend with small scripted observations for DAD/error paths. Real kernel tests cover MTU, creation, lifetimes and partial progress after an injected address failure.
• Document the complete assumptions and asynchronous kernel behaviour in README.

The parser follow-up at 85238823ae8760298108ab18da886ece1c87f56a removed 551 net lines relative to 3e12a48. At that revision, compared with the initial extraction at 10fecd3, this was 1012 fewer lines, comprising 482 fewer production Go lines, 546 fewer test lines, and 16 added documentation/build/dependency lines. The suite is 26 top-level tests / 240 leaf scenarios, versus 43 / 381 initially.

Scratch runtime

• The final Docker stage is FROM scratch; it contains the CGO_ENABLED=0 executable and LICENSE/NOTICE only. Go 1.27.1 build/test stages are unchanged.
• No shell, Netplan executable, OS packages or runtime shared libraries are required. Configuration remains externally mounted read-only.
• Preserve the existing root/privilege contract for kernel netlink operations and writable namespace-local IPv6 sysctls; never mount host /proc/sys.
• Built and loaded both Linux amd64 and arm64 images with BuildKit. Native amd64 -check passed with no network/capabilities and a read-only root filesystem.
• Ran the actual scratch image twice against an isolated network namespace. A separate netlink observer verified loopback IPv4/IPv6, dummy creation, MTU, UP, disabled automatic IPv6LL and permanent/preferred address lifetimes after bootstrap and restart.

Verification

• Go 1.27.1 build, go vet, module checksum verification, gofmt and diff whitespace checks.
• Full isolated-netns/CLI suite: go test -race -count=1 -p=1 ./..., with both opt-in environment variables enabled.
• Deterministic testing/synctest verifies actual backoff timing and cancellation during the retry timer; a constant-backoff mutation fails the test.
• Multi-platform scratch build and native runtime smoke as described above; arm64 runtime execution was not performed locally.
• GitHub CI passed on this HEAD: Docker test/runtime image builds, unit/race/kernel integration and unprivileged validation.
• Updated migration plan: https://a.yandex-team.ru/review/14594613.