fix(network): enforce owned app networks

[vishr]

Summary

• make <app>_default and ob_<app> explicit external networks owned by Onebox
• reject foreign or ambiguous derived-name collisions without adopting them
• preserve legacy Compose/service networks only with independent ownership evidence
• remove owned external networks safely during full destroy while retaining recovery state on attached endpoints
• reserve ingress names that collide with Onebox-managed networks
• document the ownership and destroy lifecycle

Refs #35

Validation

• just check
• just lint (0 issues)
• go test -race ./... (1,466 tests)
• just e2e against the OrbStack Docker daemon (full suite, 288s)
• targeted real-Docker network ownership lifecycle after final changes
• Ubuntu 24.04 OrbStack VM A/B: merged main silently accepted a foreign <app>_default; this branch rejects it, creates labelled app/service networks, and preserves an attached unmanaged endpoint across release teardown
• independent codex review --uncommitted: no actionable correctness issues