jaahd: NodeLink pin survives networkd on every

Goal: a host node's NodeLink mount-target pin (priority-5199 /32, `nodelink_mount.pin_mount_target_by_main`) can never be dropped while the mount is up, and the first boot's legacy alias mount never times out. Carries draft 7620. 1. Write the networkd keep-foreign-rules drop-in (`ManageForeignRoutingPolicyRules`) on any host whose NodeLink pin is in use, not only vnode hosts. Otherwise, re-assert the pin on every converge pass. 2. `legacy_up` in `packaging/jaah-shared-mount` applies the helper's pin (for example a `pin` verb) before mounting the alias store. Out of scope: SG, peering, terraform; the pin logic itself. Done means: - On a non-vnode hosted machine, the pin survives `networkctl reconfigure` (or returns on the next converge), and the legacy alias mount succeeds on first boot. Required checks: ./dc check full

Networkd keep-foreign-rules drop-in now on any NodeLink host; live pins re-asserted every converge (never re-proved away); legacy_up pins before mount.efs. Quick gate + changed-area tests green; PR #6180 queued in merge lane. Not live-verified on a hosted machine.