openstack-sync: follow-ups from router flavors plugin review (#2217)

Follow-on work from the review of #2217 (the router flavors sync plugin). None of these blocked the merge, so they are tracked here instead.

Original comment: https://github.com/rackerlabs/understack/pull/2217#issuecomment-5396647746

1. Prune can delete flavors owned by another credential group

Prune groups CRs by credentials ((secret_name, cloud_name)), then deletes every operator-owned flavor in the project whose name is not in that group's desired list. If two credential groups point at the same Neutron project, group A's prune sees group B's flavors as unwanted and deletes them.

Ownership markers do not help here, because both groups' flavors carry the same marker.

Idea: scope prune by the project the connection is actually authenticated to, or record which CR owns a flavor so prune only considers its own.

• openstack_sync/hooks/framework.py — _run_prune, group_by_credentials
• openstack_sync/plugins/neutron/router_flavors/prune.py — prune_removed_flavors

2. A single-CR event triggers a prune sweep in every credential group

prune_credentials is built from the whole snapshot, which spans all credential groups. So editing one CR runs a full prune against every group, not just the one that changed. That is extra API calls and extra chances to delete something by mistake.

• openstack_sync/hooks/framework.py:390

3. Orphaned profiles are never cleaned up when prune is disabled

_prune_orphaned_profiles only runs from inside prune_removed_flavors, which is gated on NEUTRON_ROUTER_FLAVOR_PRUNE. With prune off, an owned service profile left behind by a partial failure stays forever. Cleaning up an owned, unattached profile is safe and arguably should not need prune enabled.

• openstack_sync/plugins/neutron/router_flavors/prune.py — _prune_orphaned_profiles

4. find_matching_profile does not re-check the driver

The candidate list comes from profiles_for_driver, which relies on Neutron's server-side driver= filter. find_matching_profile then matches on meta_info only. If that filter is ever ignored, or the cache is reused with a wider list, a profile with the wrong driver can be matched and bound. Re-checking the driver in the match is cheap insurance.

• openstack_sync/plugins/neutron/router_flavors/reconcile.py:83

5. KeyError in _split_events aborts the whole batch

context["watchEvent"] is a bare index. An Event context without that key raises KeyError and takes down every other object in the batch. The nearby object lookup already handles a missing key with a warning and continue; this should do the same.

• openstack_sync/hooks/framework.py:337