fix(ipsec-xfrm): preserve CREATE|EXCL duplicates in MockXfrmBackend

[VerifiedOrganic]

Problem

LinuxXfrmBackend::install_sa and install_policy issue netlink mutations with NLM_F_CREATE | NLM_F_EXCL. A colliding pre-existing object therefore yields the definitive XfrmError::AlreadyExists result and remains unchanged.

MockXfrmBackend currently diverges:

• install_sa uses map insertion and replaces an existing mock key before returning Ok(());
• the revised SA map also keys on if_id and permits otherwise identical destination/protocol/SPI/lookup-mark tuples on different XFRM interfaces, but Linux xfrm_state_add collision lookup does not use if_id as an SA uniqueness discriminator;
• install_policy treats an existing selector/direction/mark/if_id identity as an idempotent Ok(()).

This can make mock-backed tests claim ownership acquisition or represent coexisting SA state that the Linux backend rejects. It is especially unsafe for staged ownership and pre-existing-object coverage in #409.

Required contract

• An SA install that collides under Linux CREATE|EXCL lookup semantics returns XfrmError::AlreadyExists and does not replace or alter the pre-existing record.
• For SAs, a different if_id does not make an otherwise colliding destination/protocol/SPI/lookup-mark tuple independently installable. Exact GETSA may verify the returned if_id, but Linux SA create, GET, and delete lookup do not select by it.
• An exact duplicate policy install returns XfrmError::AlreadyExists and does not replace, duplicate, or alter the pre-existing policy. Policy if_id remains part of the Linux policy lookup identity.
• Operation capture may record the attempted mutation, but stored state must remain unchanged.

Required tests

• Install an SA, retry the same Linux lookup identity with different non-identity parameters or key material, assert AlreadyExists, then query and prove the original state remains.
• Attempt the same SA lookup identity with a different nonzero or absent if_id, assert AlreadyExists, and prove the original if_id and state remain unchanged. Cover scoped-first and unscoped-first cases.
• Install a policy, retry the same selector/direction/mark/if_id identity with different non-identity parameters or templates, assert AlreadyExists, then prove the original policy remains present exactly once and can be removed exactly once.
• Cover unscoped and nonzero policy if_id identities.

The regression must exercise the public MockXfrmBackend, not a private test-only backend.

[VerifiedOrganic]

Implementation is in progress alongside #409 because the mock CREATE|EXCL semantics are part of the same staged-ownership safety proof. The repair will keep Linux-compatible SA collision identity (excluding if_id), preserve pre-existing state on duplicate SA/policy attempts, and add public-backend regressions before the combined opc-ipsec-xfrm candidate is reviewed. No separate overlapping branch will be opened.

[VerifiedOrganic]

Additional Linux parity gap: SA mark collision is masked lookup, not pair equality

The revised mock SA store keys on exact Option<XfrmMark> equality. Linux CREATE|EXCL collision does not.

xfrm_state_add computes the incoming lookup value as new_mark.value & new_mark.mask, then __xfrm_state_lookup treats an existing same destination/protocol/SPI state as a collision when:

(incoming_lookup_value & existing_mark.mask) == existing_mark.value

if_id is not part of that lookup. Different XfrmMark value/mask pairs can therefore collide, while non-overlapping lookup values may coexist. An existing unmarked state also has zero value/mask and matches an incoming lookup under this kernel predicate. Exact Rust map-key equality can represent states that Linux CREATE|EXCL would reject.

Please make mock insertion search the same-core SA records with the Linux masked-mark predicate before mutation. Add public-backend regressions that:

• install a canonical mark such as { value: 0x10, mask: 0xf0 }, attempt { value: 0x10, mask: 0xff } on the same SA tuple, and require AlreadyExists with the original state unchanged;
• cover the reverse insertion order for that overlapping pair;
• prove a genuinely non-colliding mark pair is still allowed;
• cover an existing unmarked SA followed by a marked same-tuple attempt according to the kernel predicate.

Please also qualify any documentation that currently claims marked and unmarked SAs are unconditionally distinct identities.