Complete Phase 2 reconciler recovery and audit coverage

[kacy]

Summary

• complete the remaining Phase 2 reconciler recovery work in one branch
• quarantine stale durable endpoints for both missing cluster nodes and missing local containers
• extend audits to compare runtime state against the live DNS registry, DNS interceptor map, load balancer backend map, and compatibility mirror
• add bounded retry backoff for repeated audit mismatches instead of retrying every pass

Verification

• zig fmt on touched files
• bounded zig build test runs after the fixes timed out at 30s with no emitted failures
• targeted compile and test runs were used to clear concrete compiler errors while landing the new audit helpers and retry logic