Apply plans against Neutron with tagging, concurrency, and metrics

[berendt]

Closes #4

Implements the apply engine that turns a generated plan into a real Neutron topology and records how long every operation takes. Built bottom-up across six commits: a leaf metrics package, the gophercloud wrappers that feed it, the dependency-ordered executor on top, then the CLI wiring and docs.

Change set (commit order)

ab841d0 Add internal/metrics samples, collector, and aggregation
The leaf package the wrappers feed. Per-call Samples (type, op, duration, success, HTTP status, error kind) and time-to-ready Readiness records accumulate in a mutex-guarded Collector that is safe for the executor's concurrent workers. Aggregate computes overall and per-type counts, nearest-rank latency percentiles, throughput over wall-clock, an error breakdown by kind, and per-type readiness stats. The percentile math is unit-tested against a pinned input plus the empty-collector edge case.

05eda5f Add internal/neutron gophercloud wrappers with tagging
The ports-and-adapters seam to OpenStack: one create wrapper per Phase 1 resource kind (address scopes, subnet pools, networks, subnets, routers + interfaces, security groups + rules, ports), each applying a deterministic name and run tags. A cross-kind Get/Delete and a WaitForReady (capped backoff) support readiness polling and later cleanup. Every call is timed into a metrics.Collector. Errors are classified for the executor: IsRetryable covers 5xx/429/non-quota-409, and quota rejections are wrapped with the ErrQuota sentinel (preserving the response error in the chain) so the run can fail fast. Pure helpers and the classifier are unit-tested; an integration test mirrors internal/config.

bec5504 Add dependency-ordered concurrent executor with retry
Apply walks the plan as ordered stages — address scopes, subnet pools, networks, routers, security groups, subnets, rules, router interfaces, ports — resolving each kind's references from the ids prior stages produced. Within a stage, independent resources are created through a bounded worker pool capped at --concurrency, so a large plan cannot spawn unbounded goroutines. Each create retries on transient 5xx/429/409 with exponential backoff, bounded by the per-operation timeout; a quota error fails fast via errors.Is(ErrQuota) without retry, and context cancellation returns ctx.Err(). Created resources reach ready (via WaitForReady) before the next stage. A fake Neutron drives race-clean unit tests for ordering, the concurrency bound, transient retry, fail-fast quota, and cancellation.

d9b0b8a Wire neutron apply to run executor and print metrics
Implements the non-dry-run path of neutron apply: generate a run id, authenticate, build a neutron.Client bound to that id and a collector, and run executor.Apply. The timing aggregate is printed even on partial failure so a run is never silent, and SIGINT/SIGTERM cancel cleanly through the context. The cloud client is constructed only after the dry-run early return, so --dry-run still makes zero API calls. The not-implemented test is replaced with one proving the non-dry-run path attempts execution and fails hermetically when no cloud is configured.

2e4a2f6 Update README status for apply executor and metrics
Marks the resource wrappers, the executor, and metrics collection with state polling as done; notes that run records, reporting, tag-based cleanup, and the quota pre-check remain.

965a688 Align neutron integration-test skip with config test
Gates the wrappers integration test on OS_CLOUD and fails on a client error, mirroring internal/config's integration test exactly, instead of skipping on any client-creation error.

Divergences from the issue

• Resource naming. The issue specified ostester-<id>-<type>-NNNN. The implementation uses ostester-<id>-<logical>, where <logical> is the plan's logical name — which already encodes type and index deterministically — rather than re-deriving an NNNN counter the plan already provides. Net naming is still deterministic and run-scoped.
• Tagging. The issue called for ostester:run=<id> on every created resource. The implementation applies that tag plus an additional ostester:type=<kind> tag, enabling type-scoped queries and cleanup later.

Not in this slice (called out as remaining in the README)

Run records, reporting, tag-based cleanup, and the quota pre-check are deliberately out of scope here and tracked as remaining work.

---

Implemented by planwerk-review a24f4d9 with Claude:claude-opus-4-8