Record and Expose Primary-DPU Selection Source

[chet]

Parent epic: #5008

Affected multi-DPU hosts need a durable explanation for why their current boot interface was selected. This adds that contract and exposes it through the existing operator tools without changing which interface wins.

What this involves

• Define every selection-source variant up front: ExpectedMachine, Operator, RedfishUefiPci, RedfishChassisId, RedfishSerialNumber, ScoutReportPci, and LegacyUnknown.
• Add a nullable selection_updated_at for the time the current target/source decision was established. Keep observed_at reserved for Redfish verification or compatibility-baseline time.
• Add database, API-model, protobuf, RPC conversion, snapshot, and persistence support. Use a protobuf Unspecified = 0 value distinct from LegacyUnknown.
• Load existing rows as LegacyUnknown with selection_updated_at = NULL rather than inventing history.
• Mark current writers accurately: declared primary as ExpectedMachine, complete UEFI PCI as RedfishUefiPci, serial fallback as RedfishSerialNumber, and the explicit setter as Operator.
• Treat a same-target operator request as an explicit authority change.
• Preserve the selection source during Redfish interface-ID enrichment and predicted-to-stable machine-ID rename.
• Expose source and selection time through GetMachineBootInterfaces, boot-interface show, the hidden machine boot-interfaces alias, boot-interface candidates, and the managed-host web page.
• Emit a structured, metric-backed event when a multi-DPU host uses serial ordering.

Acceptance criteria

• Before/after winner-equivalence tests cover every existing selection path.
• Table-driven tests cover each source and the exact conditions that update selection_updated_at.
• Target/source changes and a same-target operator authority change update the timestamp.
• Verification, interface-ID enrichment, drift reopening, and idempotent same-source retries do not update it.
• Operator surfaces distinguish selection time from observation time.
• Metrics use bounded labels; machine IDs, MACs, serials, PCI values, and errors remain structured log context.
• This task does not add Chassis.id ordering, Scout PCI evaluation, controller-state changes, Redfish changes, or any change to the selected interface.

Part of #5008.