schema: RFC-0043 edgeKind=attachesTo on subnet/VNIC/OKE network attachments

[JeroenSoeters]

Summary

Annotates 8 fields with edgeKind = "attachesTo" per RFC-0043 (typed DAG edges):

• Subnet networking — Subnet.routeTableId, Subnet.securityListIds (without these, destroying the route table or security lists before the subnet strands traffic at runtime).
• VNIC NSGs — Instance.createVnicDetails.nsgIds, plus OKE Cluster / NodePool / VirtualNodePool NSG references. NSGs gate runtime reachability and should outlive the resources using them.
• Route rule targets — RouteRule.networkEntityId (IGW/NGW/SGW/LPG). Routes pointing at a gateway need the gateway to exist for traffic to flow.

These are reachability edges — consumers are "reachable through" producers at runtime. Without the annotation, the engine's default destroy order would tear down the producer before the consumer, breaking the runtime semantics.

Depends on

formae#484 — engine work that introduces EdgeKind. Must merge in lockstep.

Validation

Mechanical schema-only annotations; the engine's attachesTo behavior was already validated end-to-end against real AWS in the engine PR's companion debug-conformance run. Local pkl eval confirms schemas parse cleanly against the new formae@0.86.0 types.

Notes

• formae@0.86.0 pin tracks the snapshot from RFC-0043's engine branch; will track the real release when it ships.
• Out of scope (per scout-pass): no runtimeDependency candidates exist in current schema. FSS FileSystem+MountTarget (the OCI analog to EFS) would be a textbook runtimeDependency case if/when those resource types are added.
• Parent-pointer / containment fields (Subnet.vcnId, *.compartmentId, etc.) deliberately NOT annotated — they're already handled correctly by default edges via Schema.Parent.

RFC: https://github.com/platform-engineering-labs/rfcs/blob/rfc-0043-typed-dag-edges/rfc-0043-typed-dag-edges.md