fix(k8s): reconcile Cilium devices on join

[xtrusia]

Commit 0a383c1 (0a383c1) binds the Kubernetes cluster endpoint to the internal space.
During a local control node join, this binding can change while Cilium on existing control nodes still uses the management interface.
EnsureCiliumDeviceByHostStep only checked the joining node, so existing nodes kept the old device configuration until a full refresh.

The local join plan now checks the joining node and existing control nodes that already have the Sunbeam hostname label.
FQDN-scoped reconciliation still avoids stale resource deletion.

Cilium reconciliation uses the existing k8s-plan lock.
This serializes it with Terraform apply and other join or refresh commands.
Clusterd creates missing locks with create-only semantics so concurrent first requests cannot both succeed.
EnsureCiliumDeviceByHostStep calculates and applies changes once while holding the lock and releases it from finally.

QA steps

The regression was reproduced with two Ubuntu 24.04 LXD VMs.
Both VMs had management and internal interfaces, with the default route only on the management interface.

1. Install revision 995 and bootstrap node 1 with the control role.
2. Add the internal subnet to the Juju internal space and install a test build of revision 996 that maps Networks.INTERNAL to that space.
3. Join node 2 with the control role.
4. Check the endpoint binding, Node InternalIP, CiliumNodeConfig, Cilium pod identity, and live Cilium device on node 1.
5. Run sunbeam cluster refresh --force --no-hints and check the same state again.

During the join, the endpoint binding and node 1 InternalIP moved to the internal network.
Node 1 kept its original Cilium pod and management device.
The full refresh updated its CiliumNodeConfig, replaced the pod, and moved Cilium to the internal device.

To test this change, restore the pre-endpoint-transition snapshots, install a snap built from this branch, and repeat the node 2 join.
Node 1 should move to the internal device during the join without a later full refresh.

Links