smartcontract/cli: improve resource verify (flex-algo, duplicate usage, out-of-range loopback IPs, code labels)

[elitegreg]

Summary of Changes

• verify_segment_routing_ids now walks Interface.flex_algo_node_segments alongside the base node_segment_idx, so per-topology segment IDs allocated by interface-create and the assign_node_segments backfill are counted as in-use instead of appearing under "Allocated but not used."
• verify_device_tunnel_block filters loopback and link IPs through the block's base_net before counting them as in-use. Caller-supplied IPs (most commonly globally routable user-tunnel-endpoint loopbacks) skip the allocator onchain and were being falsely flagged as "Used but not allocated."
• A value with multiple owners is now emitted as a single DuplicateUsage that lists every owner (collapsing N-way collisions into one entry) and is suppressed from the "Used but not allocated" section, where it was previously double-reported.
• Output now annotates device and link pubkeys with their code — e.g. Device interface Loopback0 dz1 (ABC...) and Link xams-mad (XYZ...) — in the "Used but not allocated", "Duplicate usage", and "Orphaned resource extensions" sections.
• Documented in smartcontract/programs/CLAUDE.md that any new ResourceExtension allocation/deallocation must update the corresponding verify_* function in the CLI so the verifier stays in sync with onchain state.

Diff Breakdown

Category	Files	Lines (+/-)	Net
Core logic	1	+133 / -120	+13
Tests	1	+414 / -0	+414
Docs	1	+4 / -0	+4
Total	2	+551 / -120	+431

The net production-code change is small (an enum-variant refactor, two helper rewrites, two base_net.contains filters, and a pubkey-label map); the bulk of additions are tests that lock down the new behavior.

Key files (click to expand)

• smartcontract/cli/src/resource/verify.rs — flex-algo segments folded into verify_segment_routing_ids; verify_device_tunnel_block skips loopback/link IPs outside the block's base_net; DuplicateUsage enum now carries accounts: Vec<(Pubkey, String)>; insert_usage is append-only and check_discrepancies emits one combined duplicate per value and skips those values when reporting UsedButNotAllocated; VerifyResourceResult gains a pubkey_labels: HashMap<Pubkey, String> populated from device/link codes, and the display layer prints code (pubkey) everywhere; 6 new tests + helpers
• smartcontract/programs/CLAUDE.md — new "Resource Allocation" rule pointing processor authors at verify_* in smartcontract/cli/src/resource/verify.rs

Testing Verification

• New tests covering (1) flex-algo segment allocated + counted, (2) flex-algo segment used-but-not-allocated produces a single discrepancy with the topology in the description, (3) duplicate-usage suppresses the redundant UsedButNotAllocated, (4) triple collision collapses into a single DuplicateUsage with accounts.len() == 3, (5) loopback IP outside DeviceTunnelBlock.base_net (user-tunnel-endpoint case) is not reported, (6) device codes are rendered alongside pubkeys in the output.
• All 12 pre-existing resource::verify tests continue to pass.