neutron: roll back Palo Alto interface wiring after post-create failures

[cardoe]

Follow-up to PR #2310. This is not intended to block merging that PR.

Problem

PR #2310 realizes Palo Alto interface wiring from the ROUTER_INTERFACE / BEFORE_CREATE callback and compensates through ABORT_CREATE. That abort event only covers failures raised by BEFORE_CREATE subscribers. Neutron can still fail afterward while _add_router_port() creates or validates the RouterPort association—for example, overlapping-subnet validation can reject the attachment.

For attach-by-port, Neutron restores the original port through an update rather than a deletion. In that failure window, Palo Alto subport/trunk wiring created by the callback can remain orphaned even though the router interface was not attached.

Follow-up approach

Handle this through the planned periodic agent reconciliation job rather than extending the synchronous API callback. The reconciler should treat Neutron state as desired state and repair or remove stale Palo Alto realization after the mechanism driver has completed.

Desired behavior

• Detect Palo Alto subport/trunk wiring for which no router-interface association exists.
• Remove only resources created for the stale attachment, preserving shared parent, trunk, VIF, gateway, and interface state still in use.
• Converge safely and idempotently across retries and partial failures.
• Add coverage for post-BEFORE_CREATE failures, including attach-by-port and attach-by-subnet.

Related: #2310.