Evict state minted against a replaced interface

[sbogomolov]

Interface-recreation recovery repaired the capture and its group memberships.
This drops the state that cannot be repaired: bound sockets and egress pins minted
against the interface's old kernel object, which are dead however the replacement
resolves — including when it comes back with the same addresses, where the
address-comparison predicates saw nothing to do.

How a holder finds out

Interface counts replacements, and InterfaceRef pairs a borrowed pointer with
the generation its holder last saw. A holder asks (TakeReplaced()) rather than
being told.

That was the second design. The first added a Reflector::OnInterfaceReplaced
virtual fired from inside the reconcile loop, which meant two notifications with
different rules about what a handler may read — the existing broadcast runs after
the loop precisely because handlers read live interface state, and interfaces later
in the pass are not reconciled yet. Pulling removes the difference instead of
documenting it: Application writes a counter mid-loop, holders read it from the
existing post-loop broadcast, and an integer compare carries none of that ordering.
operator-> keeps every ordinary read unchanged; Get() is deliberately explicit
so stashing the bare pointer, and losing the tracking with it, has to be a choice.
TakeReplaced() checks and acknowledges in one step, so there is no separate
acknowledgement to forget.

DIAL proxy

Asymmetric, because a listener binds a source_if address while every upstream is
egress-pinned to target_if. A source replacement drops connections and listeners;
a target replacement drops connections only and leaves the listeners serving, since
Connect reads target_if live and the next one pins the fresh interface itself.

A detached capture or a moved index is a replacement. Memberships gone from a
still-attached capture is a failed re-join on a live interface — it needs repairing,
but evicting over it would throw away working listeners.

Search sessions (a live bug, no recreation required)

SsdpReflector::OnInterfaceChanged never touched the session table. A session's
reservation is bound to the target's source address and its response registration
captures on the target's socket, so a target that was merely re-addressed left every
in-flight session holding a port nothing would arrive on until it expired.

A replacement drops them wholesale, since they all sit on the same leg; short of
that, a session goes when the target no longer has the address it reserved — the
address responders reply to. A source-side change leaves them alone.

Testing

918 unit tests native (Debug, ASan/UBSan), 907 in docker. Each new behaviour was
mutation-checked: suppressing the generation bump fails only the detach test;
dropping listeners on the target leg fails only the target-asymmetry test;
suppressing the session replacement check and the session address predicate each
fail only their own test. Both commits build standalone.