fix(ipsec): reconcile owned connections after local endpoint changes

[chen21019]

Repair

Bind the IPsec connection cache to the local Agent address and the complete effective IKE configuration. Update the cache only after a successful load; discovered connection names are not ownership evidence.

After connections, policies and routes succeed, retire only the exact previously owned local-endpoint IKE ID. Preserve foreign or ambiguous associations, explicit identities, crypto settings, firewall backend selection and plugin ownership boundaries.

Verification

Targeted connection tests (8 tests plus 9 negative subcases) and a Linux cross-build passed with the existing Go 1.26.6 toolchain. Four real-Git history contract tests passed. Security and CodeQL gates on the candidate SHA are pending; both will be rerun against the final merged SHA before the separate numeric v0.14.38 release. No published digest or live endpoint-change acceptance is claimed here.

The release history gate now permits normal reviewed PR merges while retaining clean-tree, reviewed-ancestor, nonempty-delta and exact-SHA checks. Its regression test runs inside the Security gate.

[chen21019]

Superseded by signed-source PR #26, now normally merged as c143e9a. The reviewed tree is unchanged. Same-commit main Security and CodeQL gates 37266561280 / 37266569003 passed. Release v0.14.38 is in progress; this closure does not claim deployed acceptance.