Staged configuration addition and removal audit for Vrf_lite

[sivakasi-cisco]

VRF Lite attachments staged with deploy=false were skipped as "no change"
on a subsequent run that requested deploy=true with the same configuration,
leaving controller-pending intent undeployed. Discover that pending intent
during query and redeploy it instead of treating it as idempotent.

• query: derive attach_state and flag PENDING/OUT-OF-SYNC/FAILED attachments
  as pending; publish _pending_deploy_targets (write/delete op per attachment)
  and _not_in_sync_vrfs for downstream consumers.
• deploy: scope pending targets to the requested state (merged -> configured
  pairs, replaced -> configured VRFs, overridden -> all, deleted -> delete ops),
  honor disabled_vrfs/disabled_pairs, and gate deployment on scoped pending
  targets in _needs_deployment; swallow the non-fatal HTTP 500 vPC config-save
  sanity error.
• config_transform: suppress the false "No matching VRF Lite attachment found
  to delete" warning for staged pending-deletes.
• orchestrators/manage_vrf_lite: seed pending-target params, fold pending
  targets into changed_vrfs, and gate on _needs_deployment.
• tests: add unit coverage for pending discovery, state scoping, and gating;
  update merge integration tasks to re-deploy staged intent until idempotent.

Fixes #468