fix(net): enforce TCP device binding across routing and accept

[fslongjin]

Summary

Fix TCP SO_BINDTODEVICE end to end. The option previously reported success without constraining TCP traffic. With two interfaces on the fixture subnet, SYN-ACKs consequently used the wrong output interface and the original three handshake tests timed out before reaching their accept assertions.

• Reuse the common device-binding ABI and namespace/permission checks; account for device domains in TCP port reservations.
• Carry physical ingress and constrained transmit metadata through the stack. Snapshot the device at SYN acceptance, preserve it for accepted children, and update future listener slots and overflow lookup together per interface.
• Honor the bound device during active IPv4 source/route selection, preserve wildcard-bound ports, and commit reservation narrowing only after successful connect.
• Remove the separate self-connect queue/state. Native TCP self-connect now respects device changes and retransmission rather than bypassing the network path.
• Fix the common shutdown path exposed by that removal: FIN follows submitted data without waiting for ACKs; only unsubmitted cork data delays FIN. Serialize cork enqueue and shutdown, and include local shutdown bits in poll events.
• Add device-binding/handshake inheritance tests and corked-data shutdown coverage. Existing self-connect assertions now wait for the actual input/FIN event instead of assuming synchronous delivery.

Dependency and scope

Dependency DragonOS-Community/smoltcp#31 is merged. Both Cargo files pin merge commit 9805dae47858c7247303d9d6d19ca504632c1e4a on dragonos/v0.12.0. Its source tree is identical to the previously tested revision; locked Cargo dependency resolution passed after the revision update.

This fixes the IPv4 device-binding failure. Native IPv6 cross-interface routed output and existing scope-id limitations are not implemented here. Passing IPv6 loopback regressions does not imply that broader capability.

Validation

• make fmt, make kernel, and staged diff whitespace check passed.
• Fresh DragonOS QEMU snapshot with standard network fixtures and no temporary peer host route: handshake suite runs first, 5/5 passed (including all original three cases).
• 148 guest tests passed in total: handshake 5, device binding 9, dual-family self-connect 16, bind 4, dual-stack 11, close 6, relisten 40, overflow 12, listener poll 3, nonblocking 21, readv 13, UDP device binding 8.
• Additional handshake repetition: 20 rounds × 5 cases, all passed.
• nginx: 10 default start/graceful-quit rounds passed; last five include IPv4/IPv6 HTTP body comparison. Checked master/worker exit, pidfile removal and listener closure.
• Linux reference self-connect suite: 16/16 passed.
• Dependency validation: 646 smoltcp library tests and six feature configurations passed.
• Independent three-role review covered concurrency/security, correctness and system/performance. A reservation rollback race was confirmed, corrected and independently rechecked.

Full gVisor coverage was not run. Synthetic-peer loop-warning messages can still occur; this PR does not claim to eliminate every fixture routing warning.

[fslongjin]

@codex review