Phase 1: add stable service VIP allocation

[kacy]

Summary

• add src/network/vip_allocator.zig for stable service VIP allocation from 10.43.0.0/16
• add store-level ensureService so service creation can allocate under BEGIN IMMEDIATE and preserve an existing VIP on retries
• keep runtime callers untouched for now; this slice only establishes deterministic persisted VIP allocation

Commits

• 20bc746 Add stable service VIP allocator
• a450d1c Allocate service VIPs during ensureService

Verification

• env YOQ_SKIP_SLOW_TESTS=1 ZIG_GLOBAL_CACHE_DIR=.zig-global-cache ZIG_LOCAL_CACHE_DIR=.zig-local-cache timeout 30 zig build test -- --test-filter "allocate returns first VIP in empty service registry|allocate skips existing VIPs and fills gaps|allocate rolls into the next third octet|ensureService allocates once and returns the existing VIP thereafter" timed out after 30s with no emitted failures

Follow-up

• wire runtime service registration paths onto ensureService
• add the in-memory registry and reconciler layers that will consume the persisted VIPs