neutron: preserve Palo Alto wiring when interface port deletion fails

[cardoe]

Follow-up to PR #2310. This is not intended to block merging that PR.

Problem

PR #2310 removes Palo Alto trunk wiring from a PORT / BEFORE_DELETE callback so Neutron’s trunk port-in-use guard permits an authorized router-interface deletion. This cleanup happens before ML2 enters its transactional deletion path.

A later PORT / PRECOMMIT_DELETE callback, mechanism-driver hook, or database failure can abort the Neutron deletion after the subport—and possibly the trunk and parent VIF—has already been removed. The port and RouterPort association then remain while the live interface has lost its external wiring.

Follow-up approach

Handle this through the planned periodic agent reconciliation job rather than blocking the API call on all downstream realization. The reconciler should run after mechanism-driver processing, compare Neutron desired state with the Palo Alto trunk/VIF state, and repair drift.

Desired behavior

• Detect a router-interface association whose Palo Alto subport, trunk, parent port, or VIF wiring is missing.
• Restore the missing realization safely and idempotently.
• Keep direct, unauthorized port deletion behavior unchanged: reject it without altering wiring.
• Add coverage for failures after PORT / BEFORE_DELETE, including a failing precommit subscriber or mechanism-driver hook.

Related: #2310.